Press play to start listening
A new malware threat called Vanta Stealer is targeting Windows users through social engineering, with gamers and cryptocurrency users among its primary victims. The Python-based tool steals personal data, login credentials, and financial information shortly after being executed on a device.
Point Wild’s Lat61 Threat Intelligence Team uncovered the threat, with researchers Prathamesh Shingare and Kedar Shashikant Pandit detailing its operation in a new report shared with Hackread.com.
Point Wild researchers described Vanta Stealer as “a previously undocumented malware campaign” designed to extract sensitive data from infected computers. The attackers developed it using the Python programming language and concealed it behind software packaging and code-protection layers that make it harder for security tools and analysts to inspect.
Dr. Zulfikar Ramzan, CTO of Point Wild, said the use of commercial software protection creates “a new defense challenge for security teams” trying to stop online theft.
“Vanta Stealer weaponizes the very tools used to protect software by transforming malicious code into a seemingly invisible black box that leaves security analysts chasing shadows,” Ramzan told Hackread.com.
How the Attack Spreads and Operates
Vanta Stealer is not installed automatically. Instead, researchers said attackers rely on social engineering to trick users into downloading and running it manually. Common lures include fake invoice emails, fraudulent software updates, cracked software, and unofficial mods for games and platforms such as Minecraft, Roblox, Steam, and Riot Games titles including Valorant.
The infection begins when the victim manually runs the malicious file. Its primary compiled Python payload is a 32KB file named main.pyc. During analysis using Detect It Easy on Windows 10, researchers found that the small payload was packed inside a large CArchive containing around 216 embedded files.
To hinder analysis, the attackers used PyInstaller to package the malware and PyArmor to protect and obfuscate its code. These layered techniques make static analysis more difficult and help conceal the malware’s source code.
What Data Gets Stolen
According to Point Wild’s report, Vanta Stealer collects data from a wide range of commonly used applications. Its main targets include saved passwords, cookies, and credit card information stored in Chromium-based browsers.
It also inspects Discord tokens to determine whether compromised accounts have linked payment methods, Nitro subscriptions, or ownership of high-value Discord servers. The malware can also steal Telegram Desktop data, Mullvad VPN configuration details, screenshots, cryptocurrency wallet private keys, and wallet recovery data.
After collecting the information, Vanta Stealer creates a file named Summary.txt to catalogue the stolen data. It then packages everything into a single compressed archive.
The archive is tagged with unique victim identifiers and transmitted to the attackers through an HTTP POST request, allowing them to organise stolen information, monitor infections, and compromise victims’ accounts.
The research is concerning because Vanta Stealer can expose several parts of a victim’s digital life at once, including gaming, cryptocurrency, VPN, browser, and messaging accounts.
To reduce the risk of infection, researchers recommend avoiding cracked software, unofficial game mods, and suspicious email attachments. Users should install software only from official websites and trusted sources.
