Vanta Stealer Leverages PyArmor to Steal Browser Passwords, Crypto Wallets, and Discord Tokens

Vanta Stealer is a sophisticated piece of malware that uses layered obfuscation to steal browser passwords, crypto wallets, and Discord tokens. The malware is written in Python and utilizes PyArmor, a commercial protection framework, to thwart reverse engineering.

The analyzed sample of Vanta Stealer is a 64-bit PE executable compiled with Visual Studio 2022 and wrapped with PyInstaller, which embeds the Python runtime and required modules into a single file. Static inspection reveals a large PyInstaller CArchive containing 216 embedded files, including the main.pyc entry point.

Decompilation of main.pyc does not yield readable source code but instead shows imports from pyarmor_runtime_000000 and an invocation of _pyarmor_, alongside a large encrypted byte string payload that PyArmor decrypts at runtime. This design forces analysts to defeat PyArmor before any meaningful code review, illustrating how commodity software protection is being repurposed as an anti-analysis layer in modern infostealers.

Vanta Stealer exhibits a clearly staged collect → package → identify → exfiltrate model designed to maximize the value of each compromised endpoint. Rather than embedding browser theft logic directly, Vanta Stealer dynamically retrieves a dedicated browser credential extractor at runtime, allowing operators to update browser-harvesting capabilities independently of the main payload.

The malware orchestrates additional collection routines for Discord, Telegram Desktop, Steam, Riot/Valorant, Roblox, Minecraft, Mullvad VPN, and local cryptocurrency wallets, as well as screenshots, webcam captures, and documents containing seed phrases or private keys. Point Wild Threat Intelligence leveraged PyArmor Static Unpack (OneShot) to strip the PyArmor layer and recover the original Python bytecode for main.pyc, enabling full reconstruction of Vanta Stealer’s execution graph, modules, and data flows.