Dissecting Vanta Stealer, a Python-Based Cross-Platform Information Theft Malware

Vanta Stealer is a Python-based information stealer utilizing PyArmor protection and PyInstaller packaging to complicate defensive analysis. The malware systematically harvests credentials from Chromium-based browsers, communication platforms like Discord and Telegram, gaming applications including Steam, Riot Games, Roblox and Minecraft, cryptocurrency wallets, Mullvad VPN configurations, and sensitive documents. It performs token enrichment by validating stolen Discord credentials against the API to retrieve account details, billing information, Nitro status, and server privileges. The modular architecture downloads dedicated browser extraction utilities at runtime, maintains independence between collection modules, and generates structured inventory reports before consolidating harvested data into ZIP archives. Exfiltration occurs via HTTP POST to attacker-controlled infrastructure with victim metadata. Distribution likely occurs through social engineering campaigns involving phishing emails, trojanized...

• KeyHunter Operation: Harvard Alumni Data, Stanford Applications and LLM Key TheftCampaign2026-11-04
• The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model ResourcesMalware2026-11-02
• Stray Cat, Open Doors: How k0t Wanders Through the Network EdgeCampaign2026-10-21
• FortiBleed Operations Continue Targeting Exposed Systems Leading to Reports of LockoutsCampaign2026-10-07
• Beyond valid credentials: How exposed AWS keys are tested for Amazon Bedrock accessCampaign2026-10-06