New VVS Stealer Malware Targets Discord Accounts via Obfuscated Python Code

VVS Stealer is a Python-based information stealer that can harvest Discord credentials and tokens, among other data. The malware’s code is obfuscated by Pyarmor to hinder static analysis and signature-based detection, and it is distributed as a PyInstaller package. It sets up persistence by placing itself in the Windows Startup folder and uses a fake “Fatal Error” pop-up to prompt a restart while it exfiltrates data.

In addition to Discord data, it targets web browser data from Chromium and Firefox and can capture screenshots. The stealer is advertised for sale on Telegram, with prices starting at €10 per week and rising to €199 for a lifetime license, and Unit 42 attributes its activity to a French-speaking threat actor active in related Telegram groups.

The campaign reportedly uses Discord injection techniques to hijack active sessions, downloading an obfuscated JavaScript payload to monitor network traffic via the Chrome DevTools Protocol.