Inf0s3c Stealer: A Stealthy Python Malware Is Abusing Discord to Steal Data

Inf0s3c Stealer is a Python-based information grabber designed to exfiltrate sensitive user and system data from Windows machines, with Cyfirma’s Threat Intelligence team releasing a technical analysis of its capabilities. According to Cyfirma’s Threat Intelligence team, the malware systematically collects system details, including host identifiers, CPU information and network configuration, and even captures screenshots, building a detailed profile of the victim’s machine.

It also targets and harvests passwords, cookies, autofill data, browsing history, wallets, Discord tokens and Telegram data, while extending its reach to gaming accounts such as Roblox, Minecraft and Epic Games sessions. Persistence is achieved by copying itself into the Windows Startup folder, bypassing UAC and injecting into Discord processes for storage of tokens, with anti-VM checks and blocks against antivirus domains; it can even delete itself after execution.

Exfiltration is automated and conducted via Discord, with a RAR archive named Blank-WDAGUtilityAccount[.]rar containing the stolen data, and the analysis notes strong overlaps with the Blank Grabber and Umbral-Stealer projects, suggesting shared authorship or code reuse.