Tuesday, August 11, 2026
LIVEThe Unrelenting Cyber Battle: Hacking Threats and the Imperative of Robust Data Protection///Navigating the Cyber Labyrinth: Bolstering Defenses Against Evolving Hacking Threats///The Dual Front War: Battling Hacking and Bolstering Data Protection in the Digital Age///The Ever-Evolving Cyber Threat Landscape: Navigating Hacking and Fortifying Data Protection///The Unseen Battle: Fortifying Data in an Age of Relentless Hacking///The Unseen War: Hacking's Relentless Advance and the Imperative of Data Protection///The Evolving Threat Landscape: Hacking, Data Protection, and the Imperative for Proactive Security///Navigating the Digital Minefield: Bolstering Data Protection in an Era of Relentless Hacking///The Dual Fronts of Digital Defense: Combating Hacking and Fortifying Data Protection///Hacking's New Frontier: Fortifying Data Protection in the Age of Advanced Cyber Threats///The Dual Front: Navigating Hacking Threats and Fortifying Data Protection in the Digital Age///Navigating the Digital Gauntlet: The Evolving Nexus of Hacking and Data Protection///The Unrelenting Cyber Battle: Hacking Threats and the Imperative of Robust Data Protection///Navigating the Cyber Labyrinth: Bolstering Defenses Against Evolving Hacking Threats///The Dual Front War: Battling Hacking and Bolstering Data Protection in the Digital Age///The Ever-Evolving Cyber Threat Landscape: Navigating Hacking and Fortifying Data Protection///The Unseen Battle: Fortifying Data in an Age of Relentless Hacking///The Unseen War: Hacking's Relentless Advance and the Imperative of Data Protection///The Evolving Threat Landscape: Hacking, Data Protection, and the Imperative for Proactive Security///Navigating the Digital Minefield: Bolstering Data Protection in an Era of Relentless Hacking///The Dual Fronts of Digital Defense: Combating Hacking and Fortifying Data Protection///Hacking's New Frontier: Fortifying Data Protection in the Age of Advanced Cyber Threats///The Dual Front: Navigating Hacking Threats and Fortifying Data Protection in the Digital Age///Navigating the Digital Gauntlet: The Evolving Nexus of Hacking and Data Protection///
Subscribe
Cyber Security
Independent · Digital
Thehackingpost
RSSSubscribe
CybersecurityAI-assisted

VVS Stealer Attacking Discord Users to Exfiltrate Credentials and Tokens

## Overview of VVS Stealer Malware Targeting Discord Users

MBy Mark JensenJan 14, 20261 min read

Overview of VVS Stealer Malware Targeting Discord Users

Discord users are currently facing a threat from VVS Stealer, a Python-based malware designed to extract sensitive account data such as credentials and tokens.

VVS Stealer is distributed via PyInstaller as a package and employs Pyarmor version 9.1.4 (Pro) to obscure its code, complicating detection by security tools. The malware targets Discord data, intercepts active sessions, and extracts web browser information, including cookies, passwords, browsing history, and autofill details.

The malware initiates data collection upon execution, gathering Discord tokens, account information, payment methods, user IDs, and more. It checks for two-factor authentication and sends the data to attackers via Discord webhooks. Additionally, it kills any running Discord processes and injects a harmful JavaScript payload into the Discord application directory.

VVS Stealer affects multiple web browsers, including Chrome, Firefox, Edge, Brave, Opera, and Yandex. It extracts autofill data, cookies, browsing history, and saved passwords, compressing this information into a ZIP file for exfiltration to predefined endpoints.

The malware initiates data collection upon execution, gathering Discord tokens, account information, payment methods, user IDs, and more.
Mark Jensen · Thehackingpost

The malware ensures persistence by copying itself to the Windows Startup folder, enabling it to activate every time the system starts.

Technical Breakdown of the Infection Mechanism

The analyzed malware sample has the SHA-256 hash c7e6591e5e021daa30f949a6f6e0699ef2935d2d7c06ea006e3b201c52666e07 and is set to expire after October 31, 2026. It uses PyInstaller to compile Python code into an executable file. Key components extracted include the Python bytecode file vvs and the Pyarmor runtime DLL file pyarmor_runtime.pyd .

VVS Stealer employs AES-128-CTR encryption with specific keys and values for operational concealment. The encryption key 273b1b1373cf25e054a61e2cb8a947b8 and nonce XOR key 2db99d18a0763ed70bbd6b3c are pivotal in its encryption process.

Advertisement

All network requests are characterized by the fixed User-Agent string: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 . The malware searches for encrypted Discord tokens in .ldb or .log files, decrypting them using the Windows Data Protection API.

Based on reporting by Cyber Security News.

AI transparency. This article was produced with the assistance of artificial intelligence and published under human editorial oversight. AI systems can make mistakes. Read how we use AI (EU AI Act, Art. 50).
Related Stories
Cybersecurity

Why Fintech Banking Platforms Are Reducing Operational Costs by 40%

Paige Monroe · Mar 26, 2026
Cybersecurity

Dogecoin Price Prediction: SHIB Burns 172M Tokens as Pepeto Exchange Earns From Every Trade

Eric Wallace · Mar 26, 2026
Cybersecurity

Solana Price Prediction: SOL Holds $86 With Commodity Status as Pepeto Targets Bigger Returns

Zachary Burns · Mar 26, 2026
Cybersecurity

Open Directory Malware Campaign Uses Obfuscated VBS, PNG Loaders and RAT Payloads

Joseph Cain · Mar 26, 2026