Vanta Stealer Empties Browser Vaults, Crypto Wallets and Gaming Accounts in Minutes

Vanta Stealer is a newly analyzed information-stealing malware built to strip valuable data from an infected computer quickly.

It reaches far beyond saved browser passwords, pulling cookies, payment details, account tokens, wallet files and private documents into one collection.

The threat appears designed for victims who keep much of their digital life on a Windows device.

A successful run can expose browser sessions, cryptocurrency recovery material, gaming accounts and messaging profiles, giving criminals several ways to take over accounts or steal funds.

The combination raises the stakes for everyday users, gamers and people managing digital assets, because a single infection can expose many services at once.

Analysts at Point Wild identified the malware as a Python-based stealer wrapped with PyInstaller and protected by several PyArmor layers.

That packaging makes the program harder to inspect while allowing its operators to update individual theft modules.

The initial delivery method was not visible in the analyzed sample, but the likely lures are familiar.

Phishing attachments, fake software installers, game cheats, altered code repositories, bogus updates and malicious search ads may all persuade a user to run it, a risk echoed in coverage of fake installer malware campaigns.

Point Wild said in a report shared with Cyber Security News (CSN) that the finding shows why a single download from an untrusted source can turn saved logins, tokens and wallet data into an organized package for attackers.

Vanta Stealer Empties Browser Vaults, Crypto Wallets and Gaming Accounts

Vanta Stealer targets Chromium-based browsers for passwords, cookies and stored payment information, then downloads a dedicated browser extractor while it runs.

That modular approach lets its operators refresh browser theft tools without rebuilding the main program, much like the methods described in Vidar browser credential theft.

The malware also collects Discord tokens and checks them against the service’s API to obtain account details, linked payment information and server privileges.

This transforms a stolen login token into a richer victim profile and can help criminals identify accounts that offer greater financial or administrative value.

Stolen cookies may also let an intruder reuse an active browser session, bypassing the need to know a password in some cases.

Its collection modules extend to Steam artifacts, Roblox session data, Riot Games and Valorant information, Minecraft data, Telegram Desktop artifacts and Mullvad VPN configurations.

Wallet files and documents containing recovery phrases or private keys are particularly serious targets, as illustrated by recent crypto wallet seed theft.

The malware can also capture screenshots and webcam images, adding context to the files and credentials it gathers.

It records totals in Summary.txt before creating a ZIP archive, a workflow that helps an operator judge what was taken without opening every stolen file.

Packaging, Exfiltration and Defensive Steps

The sample is a 64-bit Windows executable built with PyInstaller, with main.pyc identified as its principal application script.

PyArmor then obscures that code at another layer, slowing down analysis but not changing the simple danger: users may execute a file that looks legitimate before its collection routines begin.

Once it finishes gathering data, Vanta creates a compressed archive containing system information and the stolen material.

It sends the archive and victim-specific metadata, including a user identifier, username and execution mode, to a predefined command-and-control endpoint through an HTTP POST request.

People who suspect exposure should change passwords from a clean device, sign out of active browser and messaging sessions, and review cryptocurrency wallets for unauthorized activity.

Reinstalling affected applications and rotating recovery material where possible can limit further misuse; similar steps were urged after malicious npm package attacks.

Prevention starts with avoiding cracked software, cheats, unsolicited attachments and update prompts from unfamiliar sites.

Organizations should train staff to verify downloads, restrict unapproved software, monitor unusual archive uploads, and investigate endpoint alerts tied to the indicators below.

Security teams can also block known malicious files, isolate affected systems promptly, and preserve evidence before cleanup so they can determine whether other accounts or devices were affected and watch for account alerts.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world

The post Vanta Stealer Empties Browser Vaults, Crypto Wallets and Gaming Accounts in Minutes appeared first on Cyber Security News.