Vanta Stealer — Python-Based Cross-Platform Information Stealer Using Layered PyArmor Obfuscation
Vanta Stealer (TL-2026-1914), also tracked as Vanta Stealer, is a high-severity malware campaign, first published 2026-08-06. It has no confirmed attribution, affects Google Chromium-based Browsers, maps to 16 MITRE ATT&CK techniques (T1005, T1027.002, T1027.010), and is covered by 9 detection rules and 28 indicators of compromise.
Key facts for TL-2026-1914
- Threat ID
- TL-2026-1914
- Also known as
- Vanta Stealer, Vanta-loader
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-08-06
- Last reviewed
- 2026-08-06
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- individuals, gaming, cryptocurrency
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 28
Malware and tooling in Vanta Stealer
Malware and tooling: Python, Express.js / Node.js
Vanta Stealer is a previously undocumented Python-based cross-platform information stealer that employs layered PyArmor bytecode obfuscation atop a PyInstaller-packed executable. It targets Chromium browser credentials, Discord tokens (enriched via Discord API), Telegram Desktop session data, gaming platforms (Steam, Riot Games/Valorant, Roblox, Minecraft), Mullvad VPN configurations, cryptocurrency wallets, and sensitive documents. Stolen data is consolidated into a ZIP archive and exfiltrated via HTTP POST to a hard-coded C2 endpoint (vanta.st, hosted on DDOS-GUARD infrastructure in Russia). The analyzed sample is a 64-bit PE compiled with Visual Studio 2022, running Python 3.10, with an ~80MB CArchive containing 216 embedded files.
How Vanta Stealer works
Vanta Stealer is a Python-based, cross-platform information theft malware analyzed by Point Wild Threat Intelligence's Lat61 team (researchers Prathamesh Shingare and Kedar Shashikant Pandit). The malware represents an emerging trend of Python stealer malware adopting commercial software protection technologies as anti-analysis mechanisms.
The malware is packaged as a 64-bit Portable Executable (PE64, AMD64, Windows Vista subsystem GUI binary) compiled with Microsoft Visual Studio 2022 (MSVC 19.36.35222, Linker 14.36.35222). It employs a dual-layer anti-analysis strategy: outer PyInstaller packaging (version 2.1+, 80,092,917-byte CArchive containing 216 embedded files) wrapping inner PyArmor-protected bytecode. The core Python 3.10 payload resides in a 32 KB main.pyc entry point, which imports from a pyarmor_runtime_000000 package and invokes a __pyarmor__ bootstrap function that decrypts a large encrypted byte-string payload at runtime. Point Wild's analysts successfully deobfuscated the sample using PyArmor Static Unpack (OneShot) to recover the original Python bytecode.
The malware follows a structured collect → package → identify → exfiltrate execution model. It targets Chromium-based browsers for passwords, cookies, and stored payment card information using a runtime-downloaded browser extraction utility — a modular design that allows operators to update harvesting capabilities independently of the core payload. For Discord, it enriches stolen tokens via the Discord API, retrieving username, email, phone number, user ID, Nitro subscription status, linked payment methods, and server administrative privileges to build comprehensive victim profiles. Additional targets include Telegram Desktop session data, Steam artifacts, Riot Games/Valorant data, Roblox session artifacts, Minecraft game data, Mullvad VPN configuration files, and cryptocurrency wallet files.
Exfiltration is performed by the create_complete_zip() function, which consolidates all harvested data including system information, browser credentials, cookies, Discord account data, gaming artifacts, crypto wallets, VPN configurations, sensitive documents containing seed phrases or private keys, screenshots, and webcam captures into a single ZIP archive alongside a Summary.txt inventory report. The archive is transmitted alongside a victim metadata object (userId, username, hitType) via HTTP POST to a hard-coded C2 endpoint. The C2 infrastructure — domain vanta.st resolving to IP 185.178.208.158 — is hosted on DDOS-GUARD LTD (AS57724, Rostov-on-Don, Russia) and runs an Express.js/Node.js backend protected by DDoS-Guard anti-DDoS services. The malware checks victim public IP via api.ipify.org and icanhazip.com, and handles HTTP 200 OK for successful exfiltration and HTTP 413 for oversized payloads. The domain vanta.st has been observed serving exfiltration endpoints including /file123, /rem, and /1337, and is flagged across multiple threat intelligence platforms (ThreatFox, URLhaus) as a malware payload delivery and C2 domain. No specific threat actor group has been attributed to Vanta Stealer.
MITRE ATT&CK techniques used in TL-2026-1914
Collection
T1005 Data from Local System; T1074.001 Local Data Staging; T1113 Screen Capture; T1119 Automated Collection; T1125 Video Capture; T1560.001 Archive via Utility
Defense Evasion
T1027.002 Software Packing; T1027.010 Command Obfuscation
Discovery
T1057 Process Discovery; T1082 System Information Discovery
Execution
Command and Control
Credential Access
T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers
Resource Development
Affected products and versions in Vanta Stealer
- Google — Chromium-based Browsers
Vulnerable versions: Chrome; Edge; Brave; Opera; Vivaldi - Discord — Discord Desktop
Vulnerable versions: * - Telegram — Telegram Desktop
Vulnerable versions: * - Valve — Steam
Vulnerable versions: * - Riot Games — Valorant / Riot Client
Vulnerable versions: * - Roblox Corporation — Roblox
Vulnerable versions: * - Mojang — Minecraft
Vulnerable versions: * - Mullvad VPN — Mullvad VPN Client
Vulnerable versions: *
Remediation for Vanta Stealer
Immediate actions
- Block domain vanta.st and IP 185.178.208.158 at perimeter firewalls and DNS filters
- Deploy EDR with behavioral detection for PyInstaller-packed PE execution and PyArmor runtime behavior
- Hunt for SHA-256 hashes in published IOC list across enterprise endpoints
- Monitor for HTTP POST requests to vanta.st endpoints (/file123, /rem, /1337)
- Block external connections to api.ipify.org and icanhazip.com from non-browser processes
Workarounds
- Restrict execution of unsigned PE files from user-writable directories (Downloads, Temp, AppData)
- Enable Windows Defender ASR rules to block Office apps from creating child processes and to block executable content from email and web
- Disable or restrict access to Discord API endpoints from non-Discord processes
- Monitor for unauthorized access to browser credential stores and cookie databases
Longer-term hardening
- Implement application whitelisting to prevent execution of unsigned PyInstaller-packaged binaries
- Deploy user awareness training focused on trojanized software, game cheats, and cracked applications
- Enable browser credential guard and token protection features in EDR
- Monitor for Discord token exfiltration via API enrichment patterns
- Implement network detection for ZIP archive uploads via HTTP POST to unknown endpoints
Timeline of Vanta Stealer
- Vanta Stealer samples first observed in the wild; initial collection by Point Wild Threat Intelligence for analysis
- Vanta Stealer C2 infrastructure documented: vanta.st domain with exfiltration endpoints /file123, /rem, /1337; Express.js/Node.js backend behind DDoS-Guard protection; HTTP 413 handling observed indicating upload limits
- Joe Sandbox dynamic analysis of Vanta-loader.exe and related sample P7AnA.exe (detection score 92/100); vanta.st domain confirmed resolving to 185.178.208.158 (DDOS-GUARD, Rostov-on-Don, Russia)
- Vanta Stealer distributed via trojanized software installers, game cheats/mods, and phishing campaigns; active targeting of gamers and cryptocurrency users
- Point Wild Threat Intelligence (Lat61 team) publishes comprehensive technical analysis of Vanta Stealer, including deobfuscation methodology (PyArmor Static Unpack OneShot), full module inventory, and 19 SHA-256 hashes
- Vanta Stealer remains active in the wild with no confirmed threat actor attribution; continued monitoring by Point Wild and security community
- vanta.st domain and 185.178.208.158 IP added to multiple threat intelligence blocklists (ThreatFox, URLhaus, Avira URL Cloud); community detection rules developed
- GBHackers publishes article detailing Vanta Stealer capabilities and PyArmor obfuscation techniques, bringing broader awareness to the threat
Sources cited for Vanta Stealer
- Point Wild Exclusive: Dissecting Vanta Stealer — A Python-Based Cross-Platform Information Theft Malware
- Vanta Stealer Uses PyArmor — GBHackers
- ThreatFox — vanta.st IOC
- URLhaus — vanta.st Blocklist
- Joe Sandbox Analysis — P7AnA.exe (Vanta-loader association)
- Unit 42 — VVS Discord Stealer Using PyArmor and PyInstaller
- urlscan.io — 185.178.208.158 Intelligence
Threats related to Vanta Stealer
- Fake Roblox Xeno Script Launcher Pushes Multi-Stage Java-Based Infostealer and RAT Malware (Powercat Campaign)
- Remus Stealer: 64-bit Lumma-Derived Infostealer-as-a-Service with EtherHiding Blockchain C2 and Application-Bound Encryption Bypass
- Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures — Atomic Stealer (AMOS) and MacSync Campaign
- Lucid Stealer — Node.js-Wrapped Windows Infostealer with Hidden Remote Access (HVNC)
- Armored Likho APT Targets Government and Power Sector with New BusySnake Stealer via CVE-2025-9491 LNK Abuse
Detection coverage for TL-2026-1914
As of 2026-08-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1914 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.