VVS Stealer: The Evolving Threat to Discord Credentials

Key Findings

• VVS Stealer is a Python-based malware that steals Discord credentials and tokens

• It has been sold on Telegram since at least April 2025

• The malware uses the source code obfuscator Pyarmor to heavily obfuscate its Python code, hindering analysis and detection

Background

• VVS Stealer is marketed on Telegram as the "ultimate stealer" and is sold via subscriptions or licenses, starting at €10 per week up to €199 for lifetime access

• The malware can steal Discord data, hijack sessions, extract browser credentials, and capture screenshots

• It maintains persistence via startup installation, while operating stealthily using fake error messages

Discord Credential Theft

• VVS Stealer searches for encrypted Discord tokens with the prefix "dQw4w9WgXcQ:"

• It uses regular expressions to find these tokens in .ldb or .log files within the LevelDB directory

• The collected data, including account details, billing info, MFA status, IP address, and system metadata, are then exfiltrated via Discord webhooks

Browser Data Exfiltration

• VVS Stealer targets numerous Chromium- and Firefox-based browsers, extracting passwords, cookies, browsing history, and autofill data

• This information is packaged into ZIP archives and exfiltrated through the same webhook channels used for Discord data

Evasion and Persistence

• The malware displays a fake fatal error message using the Windows MessageBoxW API to trick users into thinking a system restart is required

• It injects obfuscated JavaScript into the Discord client to hijack active sessions, monitor user actions, and maintain persistence

Conclusion

• VVS Stealer demonstrates how tools like Pyarmor, intended for legitimate purposes, can be leveraged to build stealthy malware

• Its emergence signals a need for defenders to strengthen monitoring around credential theft and account abuse

Sources

• https://securityaffairs.com/186542/malware/vvs-stealer-a-new-python-malware-steals-discord-credentials.html

• https://thehackernews.com/2026/01/new-vvs-stealer-malware-targets-discord.html

• https://x.com/the_yellow_fall/status/2007995416923783341