PyArmor Obfuscation as a Method to Hinder Static and Signature-Based Analysis

Malware developers continue to utilize legitimate software protection tools to shield malicious code from security researchers. "VVS Stealer" is a Python-based malware family specifically targeting Discord users.

By leveraging Pyarmor, a tool designed to protect Python scripts, VVS Stealer employs complex obfuscation techniques to evade static analysis and signature-based detection, complicating reverse engineering processes.

Initially marketed on Telegram in April 2025, VVS Stealer is designed to exfiltrate sensitive data such as Discord tokens, browser credentials, and session cookies. Its most notable feature is the advanced cryptographic layers used to conceal its operations.

The VVS Stealer samples were packaged using PyInstaller and secured with Pyarmor version 9.1.4. Pyarmor, typically used by developers to secure intellectual property, blinds security tools in this context.

The obfuscation relies on BCC mode (ByteCode-to-Compilation), which converts Python functions into C functions stored within a separate dynamic-link library (DLL). This mechanism means the core logic is not visible in standard Python bytecode. Additionally, the malware uses AES-128-CTR encryption to secure its bytecode and strings.

Decrypting the payload requires extracting specific keys and nonces hidden within the Pyarmor runtime DLL, a process that challenges many automated analysis sandboxes.

Researchers successfully deobfuscated the malware by restoring the Python bytecode header and using tools such as Pycdc to recover the source code. This process revealed the malware’s true operational scope.

Once the Pyarmor protection is removed, VVS Stealer exhibits several invasive features:

Discord Injection: The malware terminates running Discord processes and injects malicious JavaScript into the application's core files, enabling it to intercept logins, password changes, and bypass multi-factor authentication (MFA). Data Exfiltration: It targets a wide range of browsers, including Chrome, Edge, and Opera, to steal cookies, history, and autofill data. The stolen information is compressed into a ZIP archive and exfiltrated via Discord webhooks. Persistence: To ensure longevity, the malware copies itself to the Windows Startup folder. It employs social engineering tactics, such as displaying a fake "Fatal Error" message box that instructs the victim to restart their computer, concealing the infection process.

The VVS Stealer case highlights the dual-use nature of software protection tools. While Pyarmor provides legitimate security for developers, its adoption by threat actors necessitates more advanced deobfuscation workflows for defenders.

Palo Alto Networks customers are protected against VVS Stealer through Cortex XDR and XSIAM, which use the Malware Prevention Engine to block such threats. Additionally, Advanced WildFire and Advanced URL Filtering identify and block the malicious domains and payloads associated with this campaign.

Based on reporting by GBHackers.