Vanta Stealer Targets Windows Users with Python-Based Malware for Rapid Data Exfiltration
A new Python-based information-stealing malware, Vanta Stealer, is rapidly exfiltrating browser credentials, crypto wallet files, gaming account data, and sensitive documents from Windows users.
Vanta Stealer, a newly analyzed information-stealing malware, is designed to swiftly extract valuable data from infected computers. It goes beyond typical browser password theft, collecting cookies, payment details, account tokens, cryptocurrency wallet files, and private documents into a single package. This threat is specifically engineered for Windows users, potentially exposing browser sessions, cryptocurrency recovery materials, gaming accounts, and messaging profiles, thereby offering attackers multiple avenues for account takeover and financial theft.
Security researchers at Point Wild identified Vanta Stealer as a Python-based malware. It is packaged using PyInstaller and further protected by multiple layers of PyArmor. This obfuscation makes the malware more difficult to inspect and analyze, while also allowing its operators to update individual theft modules without rebuilding the entire program. While the initial delivery vector for the analyzed sample was not explicitly identified, common methods such as phishing attachments, fake software installers, game cheats, compromised code repositories, bogus update prompts, and malicious search ads are likely vectors for its distribution.
The malware exhibits a particular focus on Chromium-based browsers, targeting saved passwords, cookies, and payment information. It also downloads a dedicated browser extractor module, enabling its operators to refresh browser-specific theft capabilities without altering the core malware. This modular approach mirrors techniques seen in other credential-stealing malware, allowing for adaptability and sustained effectiveness against evolving browser security measures.
Vanta Stealer also actively targets Discord tokens, validating them against the service's API to gather detailed account information, including linked payment methods and server privileges. This capability allows attackers to enrich victim profiles and identify accounts with higher financial or administrative value. Furthermore, stolen cookies can enable attackers to reuse active browser sessions, potentially bypassing the need for explicit login credentials in certain scenarios.
Beyond browser and messaging applications, Vanta Stealer's collection modules extend to artifacts from popular gaming platforms such as Steam, Roblox, Riot Games (including Valorant), and Minecraft. It also targets Telegram Desktop configurations and Mullvad VPN settings. The theft of wallet files and documents containing recovery phrases or private keys represents a particularly high-risk objective, given the direct access these provide to cryptocurrency assets.
Adding to its data-gathering capabilities, Vanta Stealer can capture screenshots and webcam images, providing valuable context to the stolen files and credentials. The malware consolidates its findings into a file named Summary.txt before creating a ZIP archive, a workflow that assists operators in quickly assessing the scope of the exfiltrated data. Once data collection is complete, Vanta Stealer creates a compressed archive containing system information and the stolen material, which is then exfiltrated to a command-and-control (C2) server via an HTTP POST request, along with victim-specific metadata.
To mitigate the risks associated with Vanta Stealer, individuals who suspect exposure should immediately change passwords from a clean device, log out of all active browser and messaging sessions, and meticulously review cryptocurrency wallets for any unauthorized activity. Reinstalling affected applications and rotating recovery materials where possible can further limit potential misuse. Organizations should focus on employee training to verify downloads, restrict unapproved software installations, monitor for unusual archive uploads, and investigate endpoint alerts associated with known indicators of compromise.