Loading malware…
VVS Stealer (also styled “VVS $tealer”) is a Python-based information-stealing malware family targeting Discord users, marketed for sale on Telegram since at least April 2025. It has been analyzed publicly (including by Palo Alto Networks Unit 42) and is distributed as a Windows executable built with PyInstaller, with heavy obfuscation via PyArmor 9.1.4 (Pro) (including AES-128-CTR-protected code/strings and PyArmor BCC mode).
Core capabilities and behavior described in the content:
Indicators explicitly mentioned in the content include:
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Python-based information stealer focused on harvesting Discord credentials/tokens; code obfuscated (PyArmor) and advertised for sale on Telegram.
Python-based information stealer that harvests Discord credentials/tokens; sold on Telegram since at least April 2025 (per excerpt).
Python-based information stealer targeting Discord and multiple web browsers. It steals Discord tokens and account/billing data, injects malicious JavaScript into the Discord client to intercept user actions (e.g., password changes, backup codes, payment methods), and exfiltrates collected data via Discord webhooks and HTTP POST to predefined endpoints. It also establishes persistence by copying itself to the Windows Startup folder.
Python-based credential stealer focused on Discord credentials; noted use of PyArmor for obfuscation and detection evasion.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.