VVS Discord Stealer Using Pyarmor for Obfuscation and Detection Evasion

Palo Alto Networks’ Unit 42 analyze the VVS Discord Stealer, a Python-based malware that targets Discord users by exfiltrating credentials and tokens stored in Discord accounts, and was marketed for sale on Telegram as early as April 2025. The sample is obfuscated with Pyarmor, including a Pyarmor runtime DLL and a marshaled bytecode payload, and the researchers deobfuscated it to reveal its operation.

The malware’s capabilities include Discord data theft and active session hijacking, injection of a JavaScript payload to enable persistence in the Discord app, and exfiltration of web browser data such as autofill, cookies, history and passwords, plus a ZIP archive of vault data. It also inserts startup persistence, displays a fake error message, and uses a fixed User-Agent for HTTP requests while exfiltrating data via HTTP POST to webhook endpoints.

The sample’s malware expires on 31 October 2026 at 23:59:59, and several SHA-256 hashes are provided to identify analyzed samples, alongside associated Discord webhook URLs. Published: 2 January 2026.