VVS Stealer: Advanced Infostealer Targets Discord Users with Pyarmor Obfuscation
In April 2025, Palo Alto Networks researchers uncovered the VVS Discord Stealer, a Python-based infostealer distributed via Telegram and targeting Discord users. Leveraging Pyarmor for advanced code obfuscation and detection evasion, the malware bundled itself as a PyInstaller executable and used sophisticated techniques such as AES-128-CTR encryption and injection of persistent JavaScript payloads into Discord’s Electron framework. VVS Stealer exfiltrated Discord credentials, tokens, browser data, and session information to attacker-controlled webhooks, targeting both Discord-specific and multi-browser artifacts with stealth and persistence. The campaign highlights the rise of infostealers employing dual-use obfuscation to bypass modern security controls, extending dwell time and increasing the risk of credential-based account takeovers across personal and enterprise platforms. This incident exemplifies an ongoing surge in credential theft campaigns leveraging advanced obfuscation tools, notably as infostealers adapt to evade both static and endpoint detection solutions. The widespread abuse of dual-use security tools for malicious purposes is fueling regulatory scrutiny and underscores the urgent need for enhanced threat visibility, real-time anomaly detection, and credential hygiene in communication and collaboration platforms.
Kill Chain
