The Invisible Predator: How VVS Stealer Abuses Pyarmor to Ghost Discord Accounts

A new analysis from Unit 42 details VVS Stealer, a Python-based threat that leverages Pyarmor to ghost Discord accounts and evade antivirus tools. According to Unit 42, the malware is marketed on Telegram and first appeared in April 2025, with affordable pricing that can be as little as €10 per week or €199 for a lifetime license.

The technique includes a Discord Injection that embeds malicious JavaScript into the Discord app’s core files, allowing it to hijack active sessions and intercept MFA codes while monitoring network traffic for payment information and mapping the victim’s social graph. Beyond Discord, the malware also harvests browser data from Chrome, Edge, Firefox and other browsers to exfiltrate cookies, passwords and autofill history.

To maintain persistence, VVS Stealer displays a fake “Fatal Error” message (Error code: 0x80070002) at installation, then sets itself to launch on every startup. The report notes that the use of Pyarmor—normally a legitimate protection tool—demonstrates how such utilities can be repurposed for credential theft on popular platforms.