Stealthy Python Malware Uses Discord to Steal Windows Data

Inf0s3c Stealer is described as a stealthy Python-based grabber that targets Windows hosts, packed as a 64-bit Portable Executable first compressed with UPX 5.02 and then packed using PyInstaller. The sample imports Windows API functions to enumerate processes, navigate directories, manipulate memory, and manage security settings, and it collects host identifiers, CPU details, network configurations, and screenshots.

It traverses user folders such as Desktop, Documents, Pictures and Downloads, compiles the stolen data into a temporary workspace, and packages everything into a password-protected RAR archive, with the default password “blank123”. After archiving, the malware exfiltrates the archive automatically to an attacker-controlled Discord channel or bot named “Blank Grabber” for automated upload.

Static analysis reveals routines for data collection, secure packaging, and covert exfiltration, including code injections into Discord for token harvesting and persistence via the Windows Startup folder, plus optional UAC bypass and anti-analysis checks. The study notes the malware’s modular architecture, obfuscation, and emphasis on Discord-based exfiltration as part of a trend toward highly adaptable Python information stealers.