VVS Stealer, a new python malware steals Discord credentials

VVS Stealer is a Python-based malware that steals Discord credentials and tokens and has been sold on Telegram since at least April 2025, according to Palo Alto Networks. It uses Pyarmor to heavily obfuscate its Python code, with researchers deobfuscating samples to analyse the malware.

Marketed as the “ultimate stealer,” it is sold via subscriptions or licenses, starting at €10 per week up to €199 for lifetime access, and can steal Discord data, hijack sessions, extract browser credentials, and capture screenshots. The malware maintains persistence through startup installation and operates with fake error messages to stay under the radar, while exfiltrating data via HTTP POST requests to predefined webhook endpoints.

It targets Discord by locating and decrypting encrypted tokens, and it also injects obfuscated JavaScript into the Discord client to hijack active sessions and monitor user actions, plus it exfiltrates browser data such as passwords, cookies and history in ZIP archives. VVS Stealer is time-limited, expiring after 31 October 2026, and uses a fixed Chrome User-Agent for its HTTP traffic.