A newly analyzed piece of information-stealing malware, dubbed Vanta Stealer, is designed to strip an infected Windows computer of far more than saved browser passwords. Researchers say a single successful run can expose browser sessions, cryptocurrency recovery material, gaming accounts, and messaging profiles all at once — giving criminals multiple paths to hijack accounts or drain funds from one infection.

A Heavily Obfuscated Python Package

Analysts at Point Wild identified Vanta Stealer as a Python-based program wrapped with PyInstaller and further obscured with multiple layers of the PyArmor protection tool. That packaging choice makes the malware considerably harder to inspect line by line, while also letting its operators swap out individual theft modules without rebuilding the entire program from scratch.

The exact delivery method used in the analyzed sample wasn’t visible to researchers, but the likely infection paths are familiar ones: phishing attachments, fake software installers, game cheats, tampered code repositories, bogus update prompts, and malicious search ads have all been used to spread similar stealers in the past.

What Gets Stolen

Vanta Stealer targets Chromium-based browsers for saved passwords, cookies, and stored payment card details, and it can download a dedicated browser-extraction module on the fly — a modular design that lets operators update theft capabilities without touching the core program. Stolen cookies are particularly valuable to attackers because they can sometimes be used to hijack an active browser session without ever needing the victim’s password.

The malware also harvests Discord tokens and checks them directly against Discord’s API to pull account details, linked payment methods, and server permissions, turning a single stolen token into a much richer profile of the victim. Its collection modules extend well beyond browsers and chat apps, reaching into:

• Steam and Riot Games/Valorant account artifacts
• Roblox session data and Minecraft files
• Telegram Desktop data
• Mullvad VPN configuration files
• Cryptocurrency wallet files and documents containing seed phrases or private keys

Point Wild’s report notes that the malware can also capture screenshots and webcam images, adding further context to the credentials and files it collects. Before exfiltrating anything, it logs a running tally of what it found in a summary file, then bundles everything into a compressed archive alongside basic system information, a victim identifier, and execution details, which it transmits to a command-and-control server via a standard HTTP POST request.

Why the Combination Matters

Individually, browser-credential stealers, crypto-wallet grabbers, and gaming-account harvesters are nothing new. What makes Vanta Stealer notable is how much of a victim’s digital footprint it tries to capture in one pass, raising the stakes for everyday users, gamers, and anyone managing cryptocurrency, since a single careless download can compromise many unrelated services simultaneously.

Recommended Response and Prevention

Anyone who suspects they’ve run the malware should change passwords from a separate, clean device, sign out of active browser and messaging sessions remotely where possible, and carefully review cryptocurrency wallets for unauthorized transactions. Reinstalling affected applications and rotating any exposed recovery phrases or API keys can help limit further damage.

On the prevention side, the advice mirrors guidance issued after similar stealer campaigns: avoid cracked software and game cheats, be wary of unsolicited attachments, and never accept update prompts from unfamiliar websites. Organizations should train staff to verify downloads before running them, restrict installation of unapproved software, monitor for unusual outbound archive uploads, and investigate endpoint alerts tied to known indicators of compromise. Security teams that identify affected systems should isolate them quickly and preserve evidence before cleanup, so they can determine whether other accounts or devices were also touched.

The Bigger Picture for Infostealer Threats

Vanta Stealer arrives amid a broader surge in infostealer development, where malware authors increasingly favor Python-based builds precisely because tools like PyInstaller and PyArmor let them iterate quickly while frustrating casual analysis. Security teams have noted a similar trend in other recent stealer families that bundle browser, gaming, and cryptocurrency theft into a single payload rather than specializing in one category.

That trend matters because it changes the economics of a single infection. Where an older-generation stealer might net an attacker a handful of reusable passwords, a tool like Vanta Stealer is built to extract maximum value from one successful execution — login sessions, financial data, gaming inventories, and crypto holdings all in one archive. For defenders, that means incident response after a suspected stealer infection can no longer stop at a password reset; it needs to account for every category of account the malware is capable of touching, from Discord and Steam to VPN configurations and wallet seed phrases.