Vanta Stealer Empties Browser Vaults, Crypto Wallets and Gaming Accounts in Minutes

Vanta Stealer is a newly analyzed information-stealing malware built to strip valuable data from an infected computer quickly.

It reaches far beyond saved browser passwords, pulling cookies, payment details, account tokens, wallet files and private documents into one collection.

The threat appears designed for victims who keep much of their digital life on a Windows device.

A successful run can expose browser sessions, cryptocurrency recovery material, gaming accounts and messaging profiles, giving criminals several ways to take over accounts or steal funds.

The combination raises the stakes for everyday users, gamers and people managing digital assets, because a single infection can expose many services at once.

Analysts at Point Wild identified the malware as a Python-based stealer wrapped with PyInstaller and protected by several PyArmor layers.

That packaging makes the program harder to inspect while allowing its operators to update individual theft modules.

The initial delivery method was not visible in the analyzed sample, but the likely lures are familiar.

Phishing attachments, fake software installers, game cheats, altered code repositories, bogus updates and malicious search ads may all persuade a user to run it, a risk echoed in coverage of fake installer malware campaigns.

Point Wild said in a report shared with Cyber Security News (CSN) that the finding shows why a single download from an untrusted source can turn saved logins, tokens and wallet data into an organized package for attackers.

Vanta Stealer Empties Browser Vaults, Crypto Wallets and Gaming Accounts

Vanta Stealer targets Chromium-based browsers for passwords, cookies and stored payment information, then downloads a dedicated browser extractor while it runs.

That modular approach lets its operators refresh browser theft tools without rebuilding the main program, much like the methods described in Vidar browser credential theft.

The malware also collects Discord tokens and checks them against the service’s API to obtain account details, linked payment information and server privileges.

This transforms a stolen login token into a richer victim profile and can help criminals identify accounts that offer greater financial or administrative value.

Stolen cookies may also let an intruder reuse an active browser session, bypassing the need to know a password in some cases.

Its collection modules extend to Steam artifacts, Roblox session data, Riot Games and Valorant information, Minecraft data, Telegram Desktop artifacts and Mullvad VPN configurations.

Wallet files and documents containing recovery phrases or private keys are particularly serious targets, as illustrated by recent crypto wallet seed theft.

The malware can also capture screenshots and webcam images, adding context to the files and credentials it gathers.

It records totals in Summary.txt before creating a ZIP archive, a workflow that helps an operator judge what was taken without opening every stolen file.

Packaging, Exfiltration and Defensive Steps

The sample is a 64-bit Windows executable built with PyInstaller, with main.pyc identified as its principal application script.

PyArmor then obscures that code at another layer, slowing down analysis but not changing the simple danger: users may execute a file that looks legitimate before its collection routines begin.

Once it finishes gathering data, Vanta creates a compressed archive containing system information and the stolen material.

It sends the archive and victim-specific metadata, including a user identifier, username and execution mode, to a predefined command-and-control endpoint through an HTTP POST request.

People who suspect exposure should change passwords from a clean device, sign out of active browser and messaging sessions, and review cryptocurrency wallets for unauthorized activity.

Reinstalling affected applications and rotating recovery material where possible can limit further misuse; similar steps were urged after malicious npm package attacks.

Prevention starts with avoiding cracked software, cheats, unsolicited attachments and update prompts from unfamiliar sites.

Organizations should train staff to verify downloads, restrict unapproved software, monitor unusual archive uploads, and investigate endpoint alerts tied to the indicators below.

Security teams can also block known malicious files, isolate affected systems promptly, and preserve evidence before cleanup so they can determine whether other accounts or devices were affected and watch for account alerts.

Indicators of Compromise (IoCs):-

Type	Indicator	Description
SHA-256	3bff25e745707056cf4ed6428ee8aace9a1bff2fb4030e32a7c0470a34cbfa62	Vanta Stealer campaign hash
SHA-256	4bdf15157fc0067af179d11e9ad168816ce99a849fd45332482b0b88a05aeabb	Vanta Stealer campaign hash
SHA-256	5dbddac39fda06acc703c22935fa24e0b4bcdbc26624a1869fe93cd568cdb9fc	Vanta Stealer campaign hash
SHA-256	6f20836eef6496695e5f2a5fd81e7dfb8770df38fb1bf67fcf024c1261352daa	Vanta Stealer campaign hash
SHA-256	09e3ce307b2af3f94a315eba97c094d8d755b3674208cc47ceab3c1630a84ad9	Vanta Stealer campaign hash
SHA-256	026c85b97a6ddac14c9835d0580228c0a82dd82ce12d8d921c2f3067a12bbb7e	Vanta Stealer campaign hash
SHA-256	31f3e50e764a090d2dbf759e6cb5f678c5c6a3a5a96ff3a2069ffda520580e52	Vanta Stealer campaign hash
SHA-256	34a01c2429161a8711adff3495ab1dee4419511c8f45c483f50ac71205f68512	Vanta Stealer campaign hash
SHA-256	44d48b4876cc99f1781877eae9d1e22e99925079a5a8cd0d9022176f5757baaf	Vanta Stealer campaign hash
SHA-256	64d85df47edd0187462786ff290f34b080f909a5dda946fa7e83fa3f40aaa878	Vanta Stealer campaign hash
SHA-256	96cc8dc992e465f5f959c7d1481e3789067a78c83706a3dd7ba5a20eaf32b701	Vanta Stealer campaign hash
SHA-256	467c192e3aeafbac29ab272575bc76545f371a50670fb4a1cf3104dae30622e0	Vanta Stealer campaign hash
SHA-256	785d6372f397470c48faa0a9a525b91cb990d0b3ed4b6452e31d75ed179a409c	Vanta Stealer campaign hash
SHA-256	858fcd9bd05d73d2dcc1496761e2f71fd0bf75fa0ae66eeb7405f788837ec384	Vanta Stealer campaign hash
SHA-256	3349f0cf1d4f294d7d98ee12e0ce03a40740668b50e5e553d843f233a0021d36	Vanta Stealer campaign hash
SHA-256	9339c056663e9f57d4b9d34b339cd85048176b9e7d9a20958b7ba190964acd47	Vanta Stealer campaign hash
SHA-256	a71c4149bcb8a77ca755ff235e91b1e774293cf3d653aaa2c41fe943cd0848f1	Vanta Stealer campaign hash
SHA-256	aa9268a758b5333d725b4b08350ec35e05b9a86f02d65b83b2d9a51e8859b5cd	Vanta Stealer campaign hash
SHA-256	b6a7d57fb37a0d9dab8a9e1a81ac6c228fefa4375611bbdf847a775c66cf96c5	Vanta Stealer campaign hash

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world