Vanta Stealer is a newly analyzed information-stealing malware built to strip valuable data from an infected computer quickly.
It reaches far beyond saved browser passwords, pulling cookies, payment details, account tokens, wallet files and private documents into one collection.
The threat appears designed for victims who keep much of their digital life on a Windows device.
A successful run can expose browser sessions, cryptocurrency recovery material, gaming accounts and messaging profiles, giving criminals several ways to take over accounts or steal funds.
The combination raises the stakes for everyday users, gamers and people managing digital assets, because a single infection can expose many services at once.
Analysts at Point Wild identified the malware as a Python-based stealer wrapped with PyInstaller and protected by several PyArmor layers.
That packaging makes the program harder to inspect while allowing its operators to update individual theft modules.
The initial delivery method was not visible in the analyzed sample, but the likely lures are familiar.
Attack Chain (Source – Point Wild)
Phishing attachments, fake software installers, game cheats, altered code repositories, bogus updates and malicious search ads may all persuade a user to run it, a risk echoed in coverage of fake installer malware campaigns.
Point Wild said in a report shared with Cyber Security News (CSN) that the finding shows why a single download from an untrusted source can turn saved logins, tokens and wallet data into an organized package for attackers.
Vanta Stealer Empties Browser Vaults, Crypto Wallets and Gaming Accounts
Vanta Stealer targets Chromium-based browsers for passwords, cookies and stored payment information, then downloads a dedicated browser extractor while it runs.
That modular approach lets its operators refresh browser theft tools without rebuilding the main program, much like the methods described in Vidar browser credential theft.
Identified as a PyInstaller Executable (Source – Point Wild)
The malware also collects Discord tokens and checks them against the service’s API to obtain account details, linked payment information and server privileges.
This transforms a stolen login token into a richer victim profile and can help criminals identify accounts that offer greater financial or administrative value.
Stolen cookies may also let an intruder reuse an active browser session, bypassing the need to know a password in some cases.
Its collection modules extend to Steam artifacts, Roblox session data, Riot Games and Valorant information, Minecraft data, Telegram Desktop artifacts and Mullvad VPN configurations.
Wallet files and documents containing recovery phrases or private keys are particularly serious targets, as illustrated by recent crypto wallet seed theft.
Unpacking the PyInstaller CArchive (Source – Point Wild)
The malware can also capture screenshots and webcam images, adding context to the files and credentials it gathers.
It records totals in Summary.txt before creating a ZIP archive, a workflow that helps an operator judge what was taken without opening every stolen file.
Packaging, Exfiltration and Defensive Steps
The sample is a 64-bit Windows executable built with PyInstaller, with main.pyc identified as its principal application script.
PyArmor then obscures that code at another layer, slowing down analysis but not changing the simple danger: users may execute a file that looks legitimate before its collection routines begin.
Once it finishes gathering data, Vanta creates a compressed archive containing system information and the stolen material.
It sends the archive and victim-specific metadata, including a user identifier, username and execution mode, to a predefined command-and-control endpoint through an HTTP POST request.
Successfully deobfuscated main.pyc using PyArmor Shot (Source – Point Wild)
People who suspect exposure should change passwords from a clean device, sign out of active browser and messaging sessions, and review cryptocurrency wallets for unauthorized activity.
Reinstalling affected applications and rotating recovery material where possible can limit further misuse; similar steps were urged after malicious npm package attacks.
Prevention starts with avoiding cracked software, cheats, unsolicited attachments and update prompts from unfamiliar sites.
Vanta Stealer execution (Source – Point Wild)
Organizations should train staff to verify downloads, restrict unapproved software, monitor unusual archive uploads, and investigate endpoint alerts tied to the indicators below.
Security teams can also block known malicious files, isolate affected systems promptly, and preserve evidence before cleanup so they can determine whether other accounts or devices were affected and watch for account alerts.
Indicators of Compromise (IoCs):-
TypeIndicatorDescriptionSHA-2563bff25e745707056cf4ed6428ee8aace9a1bff2fb4030e32a7c0470a34cbfa62Vanta Stealer campaign hashSHA-2564bdf15157fc0067af179d11e9ad168816ce99a849fd45332482b0b88a05aeabbVanta Stealer campaign hashSHA-2565dbddac39fda06acc703c22935fa24e0b4bcdbc26624a1869fe93cd568cdb9fcVanta Stealer campaign hashSHA-2566f20836eef6496695e5f2a5fd81e7dfb8770df38fb1bf67fcf024c1261352daaVanta Stealer campaign hashSHA-25609e3ce307b2af3f94a315eba97c094d8d755b3674208cc47ceab3c1630a84ad9Vanta Stealer campaign hashSHA-256026c85b97a6ddac14c9835d0580228c0a82dd82ce12d8d921c2f3067a12bbb7eVanta Stealer campaign hashSHA-25631f3e50e764a090d2dbf759e6cb5f678c5c6a3a5a96ff3a2069ffda520580e52Vanta Stealer campaign hashSHA-25634a01c2429161a8711adff3495ab1dee4419511c8f45c483f50ac71205f68512Vanta Stealer campaign hashSHA-25644d48b4876cc99f1781877eae9d1e22e99925079a5a8cd0d9022176f5757baafVanta Stealer campaign hashSHA-25664d85df47edd0187462786ff290f34b080f909a5dda946fa7e83fa3f40aaa878Vanta Stealer campaign hashSHA-25696cc8dc992e465f5f959c7d1481e3789067a78c83706a3dd7ba5a20eaf32b701Vanta Stealer campaign hashSHA-256467c192e3aeafbac29ab272575bc76545f371a50670fb4a1cf3104dae30622e0Vanta Stealer campaign hashSHA-256785d6372f397470c48faa0a9a525b91cb990d0b3ed4b6452e31d75ed179a409cVanta Stealer campaign hashSHA-256858fcd9bd05d73d2dcc1496761e2f71fd0bf75fa0ae66eeb7405f788837ec384Vanta Stealer campaign hashSHA-2563349f0cf1d4f294d7d98ee12e0ce03a40740668b50e5e553d843f233a0021d36Vanta Stealer campaign hashSHA-2569339c056663e9f57d4b9d34b339cd85048176b9e7d9a20958b7ba190964acd47Vanta Stealer campaign hashSHA-256a71c4149bcb8a77ca755ff235e91b1e774293cf3d653aaa2c41fe943cd0848f1Vanta Stealer campaign hashSHA-256aa9268a758b5333d725b4b08350ec35e05b9a86f02d65b83b2d9a51e8859b5cdVanta Stealer campaign hashSHA-256b6a7d57fb37a0d9dab8a9e1a81ac6c228fefa4375611bbdf847a775c66cf96c5Vanta Stealer campaign hash
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world
The post Vanta Stealer Empties Browser Vaults, Crypto Wallets and Gaming Accounts in Minutes appeared first on Cyber Security News.
