Cybersecurity researchers have disclosed a new Python-based information stealer dubbed VVS Stealer (also marketed as VVS $tealer), designed to harvest Discord credentials, tokens, browser data, and screenshots.
According to Palo Alto Networks Unit 42, the malware has been sold on Telegram since at least April 2025, priced as low as €10 per week, making it one of the cheapest and most accessible stealers on the market.
Key capabilities
VVS Stealer is distributed as a PyInstaller executable and uses PyArmor obfuscation, significantly complicating detection and reverse engineering.
Once executed, it:
- Establishes persistence via the Windows Startup folder
- Displays fake “Fatal Error” pop-ups to trick users into restarting
- Steals:
- Discord tokens and account data
- Browser credentials (Chromium & Firefox)
- Cookies, autofill data, and browsing history
- Screenshots
Advanced Discord hijacking
The malware performs Discord injection attacks by:
- Terminating active Discord processes
- Downloading an obfuscated JavaScript payload
- Monitoring traffic via the Chrome DevTools Protocol (CDP)
- Hijacking active Discord sessions
Researchers believe the malware is operated by a French-speaking threat actor, active in multiple stealer-focused Telegram groups.
Why this matters
Security researchers warn that:
- Python-based malware is becoming increasingly stealthy
- Obfuscation techniques like PyArmor help bypass signature-based detection
- Cheap pricing lowers the barrier for cybercriminals
Adding to the risk, Hudson Rock reports that stolen admin credentials are being reused to compromise legitimate business websites, which then unknowingly host and distribute the same infostealers — creating a self-sustaining infection loop.
“Legitimate businesses are becoming malware distribution points after their credentials are stolen by infostealers.”
Defensive takeaways
✔ Monitor for unauthorized startup persistence
✔ Detect Discord injection behavior and unexpected JS payloads
✔ Treat credential theft as a precursor to wider compromise
✔ Assume stolen credentials may be reused for supply-chain abuse
