Vanta Stealer — Python-Based Cross-Platform Information Stealer Using Layered PyArmor Obfuscation — Threadlinqs Intelligence
As of 2026-08-06, Vanta Stealer — Python-Based Cross-Platform Information Stealer Using Layered PyArmor Obfuscation is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 28 indicators of compromise.
Threat ID: TL-2026-1914 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Vanta Stealer is a previously undocumented Python-based cross-platform information stealer that employs layered PyArmor bytecode obfuscation atop a PyInstaller-packed executable. It targets Chromium
Vanta Stealer is a Python-based, cross-platform information theft malware analyzed by Point Wild Threat Intelligence's Lat61 team (researchers Prathamesh Shingare and Kedar Shashikant Pandit). The malware represents an emerging trend of Python stealer malware adopting commercial software protection technologies as anti-analysis mechanisms.
The malware is packaged as a 64-bit Portable Executable (PE64, AMD64, Windows Vista subsystem GUI binary) compiled with Microsoft Visual Studio 2022 (MSVC 19.36.35222, Linker 14.36.35222). It employs a dual-layer anti-analysis strategy: outer PyInstaller packaging (version 2.1+, 80,092,917-byte CArchive containing 216 embedded files) wrapping inner PyArmor-protected bytecode. The core Python 3.10 payload resides in a 32 KB main.pyc entry point, which imports from a pyarmor_runtime_000000 package and invokes a __pyarmor__ bootstrap function that decrypts a large encrypted byte-string payload at runtime. Point Wild's analysts successfully deobfuscated the sample using PyArmor Static Unpack (OneShot) to recover the original Python bytecode.
The malware follows a structured collect → package → identify → exfiltrate execution model. It targets Chromium-based browsers for passwords, cookies, and stored payment card information using a runtime-downloaded browser extraction utility — a modular design that allows operators to update harvesting capabilities independently of the core payload. For Discord, it enriches stolen tokens via the Discord API, retrieving username, email, phone number, user ID, Nitro subscription status, linked payment methods, and server administrative privileges to build comprehensive victim profiles. Additional targets include Telegram Desktop session data, Steam artifacts, Riot Games/Valorant data, Roblox session artifacts, Minecraft game data, Mullvad VPN configuration files, and cryptocurrency wallet files.
Exfiltration is performed by the create_complete_zip() function, which consolidates all harvested data including system information, browser credentials, cookies, Discord account data, gaming artifacts, crypto wallets, VPN configurations, sensitive documents containing seed phrases or private keys, screenshots, and webcam captures into a single ZIP archive alongside a Summary.txt inventory report. The archive is transmitted alongside a victim metadata object (userId, username, hitType) via HTTP POST to a hard-coded C2 endpoint. The C2 infrastructure — domain vanta.st resolving to IP 185.178.208.158 — is hosted on DDOS-GUARD LTD (AS57724, Rostov-on-Don, Russia) and runs an Express.js/Node.js backend protected by DDoS-Guard anti-DDoS services. The malware checks victim public IP via api.ipify.org and icanhazip.com, and handles HTTP 200 OK for successful exfiltration and HTTP 413 for oversized payloads. The domain vanta.st has been observed serving exfiltration endpoints including /file123, /rem, and /1337, and is flagged across multiple threat intelligence platforms (ThreatFox, URLhaus) as a malware payload delivery and C2 domain. No specific threat actor group has been attributed to Vanta Stealer.
Target sectors: individuals, gaming, cryptocurrency
Target regions: Global
Detections & IOCs
As of 2026-08-10, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 28 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1059.006, T1027.002, T1027.010, T1555.003, T1539, T1528, T1082, T1057, T1005, T1113
