Vanta Stealer Unveils New Modus Operandi with PyArmor Obfuscation

Vanta Stealer is a Python-based malware that uses layered PyArmor obfuscation to harvest sensitive data from compromised systems. The malware targets browser passwords, crypto wallets, Discord tokens, gaming accounts, and VPN configurations.

The analyzed sample of Vanta Stealer was compiled with Visual Studio 2022 and wrapped with PyInstaller, which embeds the Python runtime and required modules into a single executable. This modular approach allows operators to update browser-harvesting capabilities independently of the main payload, reducing the need for re-distributing full binaries.

Vanta Stealer's core stealer orchestrates additional collection routines for Discord, Telegram Desktop, Steam, Riot/Valorant, Roblox, Minecraft, Mullvad VPN, and local cryptocurrency wallets. The malware also captures screenshots, webcam captures, and documents containing seed phrases or private keys.