Audit log

Every state-changing event for Vanta Stealer — Python Infostealer Targeting Crypto Wallets: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-08-15 23:03:30Z
   Score: ? → ? (no score change)
   anchorpending

   chain

   ●—

   hash

   8e3Qx3P76dKA…CKiMkb2Mcopysha256 → base58

   verifying row…

   canonical bytes (17059 B) ▸

   {"actor":"system:backfill","investigation_id":"d9de73f6-b05b-4329-858b-caf586a1203b","kind":"publish","page_slug":"vanta-stealer-python-infostealer-targeting-crypto-wallets","published_at":"2026-08-15T23:03:29.930Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Vanta Stealer — Python Infostealer Targeting Crypto Wallets","sections":[{"content":"Vanta Stealer is a Windows-targeted information stealer written in Python and packaged as a standalone 64-bit x86-64 executable using PyInstaller. The executable embeds a Python 3.10 runtime alongside 216 bundled files inside an 80 MB CArchive, according to technical analysis published by Point Wild's Lat61 Threat Intelligence Team on July 28, 2026. Multiple independent security sources — including GBHackers, CyberSecurityNews, Cyberpress, HackRead, and PCRisk — reported on the malware in the first two weeks of August 2026, confirming active distribution campaigns targeting Windows users. No threat actor attribution or law enforcement action has been publicly confirmed as of August 2026.","heading":"Threat Overview","severity":"critical","sources":[{"credibility":2,"name":"Point Wild: Dissecting Vanta Stealer, a Python-Based Cross-Platform Information Theft Malware","type":"research","url":"https://www.pointwild.com/threat-intelligence/point-wild-exclusive-dissecting-vanta-stealer-a-python-based-cross-platform-information-theft-malware/"},{"credibility":2,"name":"GBHackers: Vanta Stealer Uses PyArmor to Steal Browser Passwords, Crypto Wallets and Discord Tokens","type":"news_article","url":"https://gbhackers.com/vanta-stealer-uses-pyarmor/"},{"credibility":2,"name":"CyberSecurityNews: Vanta Stealer Empties Browser Vaults, Crypto Wallets and Gaming Accounts in Minutes","type":"news_article","url":"https://cybersecuritynews.com/vanta-stealer-empties-browser-vaults/"}]},{"content":"Vanta Stealer is specifically engineered to locate and exfiltrate cryptocurrency wallet artifacts stored on infected Windows devices. According to Point Wild's technical dissection and corroborating reports from PCRisk and GBHackers, the malware searches for wallet files and seed phrase recovery documents in local directories. It extracts wallet recovery phrases and private keys, including those stored in plaintext documents or files commonly associated with software wallets. The malware does not limit itself to dedicated wallet applications — it also scans locally stored documents containing recovery phrases or private keys, broadening the potential impact beyond users who actively run wallet software. Successful compromise gives an attacker everything needed to drain a victim's on-chain holdings without further access to the device.","heading":"Cryptocurrency Wallet Targeting","severity":"critical","sources":[{"credibility":2,"name":"Point Wild: Dissecting Vanta Stealer — Crypto Wallet Section","type":"research","url":"https://www.pointwild.com/threat-intelligence/point-wild-exclusive-dissecting-vanta-stealer-a-python-based-cross-platform-information-theft-malware/"},{"credibility":2,"name":"PCRisk: Vanta Stealer Malware Removal Instructions","type":"research","url":"https://www.pcrisk.com/removal-guides/35704-vanta-stealer"},{"credibility":2,"name":"GBHackers: Vanta Stealer Uses PyArmor to Steal Browser Passwords, Crypto Wallets and Discord Tokens","type":"news_article","url":"https://gbhackers.com/vanta-stealer-uses-pyarmor/"}]},{"content":"Vanta Stealer is compiled with Visual Studio 2022 and packaged using PyInstaller, which bundles a full Python 3.10 runtime into a single executable to enable deployment on systems without Python pre-installed. On top of this, the malware applies PyArmor — a commercial Python code-protection tool — to encrypt its bytecode payload, with the encrypted modules executed via a `__pyarmor__` bootstrap function. This dual-layer approach (PyInstaller packing plus PyArmor bytecode encryption) requires analysts to use deobfuscation tooling such as PyArmor Shot before the malware's logic becomes readable, significantly increasing reverse-engineering effort. According to Point Wild's analysis, static inspection of the binary reveals the CArchive structure and a main.pyc entry point, but the substantive harvesting logic remains hidden behind the obfuscation layers until runtime decryption occurs.","heading":"Technical Architecture and Obfuscation","severity":"high","sources":[{"credibility":2,"name":"Point Wild: Dissecting Vanta Stealer — Technical Architecture","type":"research","url":"https://www.pointwild.com/threat-intelligence/point-wild-exclusive-dissecting-vanta-stealer-a-python-based-cross-platform-information-theft-malware/"},{"credibility":2,"name":"GBHackers: Vanta Stealer Uses PyArmor to Steal Browser Passwords, Crypto Wallets and Discord Tokens","type":"news_article","url":"https://gbhackers.com/vanta-stealer-uses-pyarmor/"},{"credibility":2,"name":"Rankiteo: Vanta Stealer — Telegram, Discord, Roblox and Minecraft Cyber Attack August 2026","type":"research","url":"https://blog.rankiteo.com/mojtelrobdis1786019150-telegram-discord-roblox-minecraft-cyber-attack-august-2026/"}]},{"content":"A notable design feature documented by Point Wild is Vanta Stealer's modular, staged architecture. Rather than embedding its browser credential extraction logic directly in the primary payload, the malware downloads a dedicated browser credential extractor at runtime from a remote source. This means the operator can update the browser-harvesting component independently, without redeploying the main executable. The practical effect is that the malware's effective capability may exceed what any single static sample analysis reveals, and that signature-based detection tied to the harvester module can be circumvented simply by updating the remotely hosted component. After dynamic retrieval, the execution flow proceeds through browser credential collection, Discord account profiling (including API validation to retrieve username, email, phone number, Nitro subscription status, and payment methods), followed by harvesting from other targeted applications.","heading":"Dynamic Module Retrieval","severity":"high","sources":[{"credibility":2,"name":"Point Wild: Dissecting Vanta Stealer — Dynamic Module Section","type":"research","url":"https://www.pointwild.com/threat-intelligence/point-wild-exclusive-dissecting-vanta-stealer-a-python-based-cross-platform-information-theft-malware/"},{"credibility":2,"name":"GBHackers: Vanta Stealer Uses PyArmor to Steal Browser Passwords, Crypto Wallets and Discord Tokens","type":"news_article","url":"https://gbhackers.com/vanta-stealer-uses-pyarmor/"}]},{"content":"Beyond cryptocurrency wallets, Vanta Stealer harvests a broad range of sensitive data. According to PCRisk and Point Wild, targeted data categories include: saved passwords and cookies from Chromium-based browsers; payment card details stored in browsers; Discord session tokens (validated against the Discord API and enriched with account metadata including Nitro status, billing, and server privileges); Telegram Desktop session files; Steam, Riot Games (Valorant), Roblox, and Minecraft account artifacts; Mullvad VPN configuration files; desktop screenshots; webcam image captures; and locally stored documents that contain wallet recovery phrases or private keys. Stolen data is consolidated into a ZIP archive together with victim metadata (userId, username, and execution mode) and exfiltrated to a hard-coded command-and-control server via HTTP POST.","heading":"Scope of Data Harvested","severity":"high","sources":[{"credibility":2,"name":"PCRisk: Vanta Stealer Malware Removal Instructions","type":"research","url":"https://www.pcrisk.com/removal-guides/35704-vanta-stealer"},{"credibility":2,"name":"Point Wild: Dissecting Vanta Stealer — Data Exfiltration Section","type":"research","url":"https://www.pointwild.com/threat-intelligence/point-wild-exclusive-dissecting-vanta-stealer-a-python-based-cross-platform-information-theft-malware/"}]},{"content":"Security researchers at Point Wild, Cyberpress, HackRead, and PCRisk have identified several suspected distribution vectors, though no single confirmed delivery chain has been documented with forensic certainty across all vectors as of August 2026. Suspected methods include: phishing emails with malicious attachments; trojanized game cheats and cracked software installers; fake software update pages; malicious repositories (including GitHub-hosted projects); search-engine optimization (SEO) poisoning; and malvertising campaigns using malicious paid search ads. The malware's targeting of gaming platforms — Steam, Roblox, Minecraft, Valorant — is consistent with distribution through game-cheating communities and software piracy channels, where users are accustomed to running unsigned executables. The use of PyInstaller packaging enables the malware to pose as a legitimate standalone application.","heading":"Distribution Methods","severity":"high","sources":[{"credibility":2,"name":"Cyberpress: Vanta Stealer May Spread Through Cracked Software, Game Cheats and Fake Updates","type":"news_article","url":"https://cyberpress.org/vanta-stealer-spreads-widely/"},{"credibility":2,"name":"HackRead: New Vanta Stealer Malware Targets Gamers, Crypto Users, and Web Apps","type":"news_article","url":"https://hackread.com/vanta-stealer-malware-gamers-crypto-users-web-apps/"},{"credibility":2,"name":"PCRisk: Vanta Stealer Malware Removal Instructions","type":"research","url":"https://www.pcrisk.com/removal-guides/35704-vanta-stealer"}]},{"content":"Point Wild's Lat61 Threat Intelligence Team published 20 SHA256 sample hashes. Two representative hashes identified in that report are: 3bff25e745707056cf4ed6428ee8aace9a1bff2fb4030e32a7c0470a34cbfa62 and 4bdf15157fc0067af179d11e9ad168816ce99a849fd45332482b0b88a05aeabb. Antivirus detection names documented by PCRisk include: Avast (Win64:MalwareX-gen [Trj]), Combo Cleaner (Trojan.Agent.GRJK), Microsoft Defender (Trojan:Win64/Tedy!pz), and Kaspersky (UDS:Trojan-PSW.Multi.Stealer). The malware's dynamic module retrieval architecture means that detections tied to the browser-harvester component may become stale if the operator rotates the remote module. Defenders should treat behavioral detections (outbound HTTP POST with ZIP payloads, runtime module downloads, PyArmor bootstrap execution) as more reliable indicators than static file signatures.","heading":"Detection and Indicators of Compromise","severity":"medium","sources":[{"credibility":2,"name":"Point Wild: Dissecting Vanta Stealer — IOC Section","type":"research","url":"https://www.pointwild.com/threat-intelligence/point-wild-exclusive-dissecting-vanta-stealer-a-python-based-cross-platform-information-theft-malware/"},{"credibility":2,"name":"PCRisk: Vanta Stealer Malware Removal Instructions — Detection Names","type":"research","url":"https://www.pcrisk.com/removal-guides/35704-vanta-stealer"}]},{"content":"As of August 2026, no public attribution to a specific threat actor, group, or nation-state has been reported by any security vendor, government agency, or law enforcement body. No indictments, charges, regulatory actions, or law enforcement operations targeting Vanta Stealer's operators have been publicly announced. The malware has not been confirmed as a sold malware-as-a-service (MaaS) offering on dark web forums, though researchers note its modular backend infrastructure and operational maturity suggest experienced operators. The absence of attribution does not indicate that the malware is inactive — distribution campaigns were confirmed active as of early August 2026.","heading":"Attribution and Law Enforcement Status","severity":"medium","sources":[{"credibility":2,"name":"Point Wild: Dissecting Vanta Stealer","type":"research","url":"https://www.pointwild.com/threat-intelligence/point-wild-exclusive-dissecting-vanta-stealer-a-python-based-cross-platform-information-theft-malware/"},{"credibility":2,"name":"GBHackers: Vanta Stealer Uses PyArmor to Steal Browser Passwords, Crypto Wallets and Discord Tokens","type":"news_article","url":"https://gbhackers.com/vanta-stealer-uses-pyarmor/"}]}],"sources_used":[{"credibility":2,"name":"Point Wild: Dissecting Vanta Stealer, a Python-Based Cross-Platform Information Theft Malware","type":"research","url":"https://www.pointwild.com/threat-intelligence/point-wild-exclusive-dissecting-vanta-stealer-a-python-based-cross-platform-information-theft-malware/"},{"credibility":2,"name":"GBHackers: Vanta Stealer Uses PyArmor to Steal Browser Passwords, Crypto Wallets and Discord Tokens","type":"news_article","url":"https://gbhackers.com/vanta-stealer-uses-pyarmor/"},{"credibility":2,"name":"CyberSecurityNews: Vanta Stealer Empties Browser Vaults, Crypto Wallets and Gaming Accounts in Minutes","type":"news_article","url":"https://cybersecuritynews.com/vanta-stealer-empties-browser-vaults/"},{"credibility":2,"name":"HackRead: New Vanta Stealer Malware Targets Gamers, Crypto Users, and Web Apps","type":"news_article","url":"https://hackread.com/vanta-stealer-malware-gamers-crypto-users-web-apps/"},{"credibility":2,"name":"Cyberpress: Vanta Stealer May Spread Through Cracked Software, Game Cheats and Fake Updates","type":"news_article","url":"https://cyberpress.org/vanta-stealer-spreads-widely/"},{"credibility":2,"name":"PCRisk: Vanta Stealer Malware Removal Instructions","type":"research","url":"https://www.pcrisk.com/removal-guides/35704-vanta-stealer"},{"credibility":2,"name":"Rankiteo: Vanta Stealer — Telegram, Discord, Roblox and Minecraft Cyber Attack August 2026","type":"research","url":"https://blog.rankiteo.com/mojtelrobdis1786019150-telegram-discord-roblox-minecraft-cyber-attack-august-2026/"}],"summary":"Vanta Stealer is a Python-based information-stealing malware first publicly documented in late July 2026 by Point Wild's Lat61 Threat Intelligence Team and subsequently reported by multiple security vendors. The malware specifically targets cryptocurrency wallet seed phrases and private keys, browser credentials, Discord and Telegram session tokens, and gaming platform accounts on Windows systems. It uses PyInstaller packaging and multiple layers of PyArmor obfuscation to hinder analysis, and retrieves its browser credential extraction module dynamically at runtime to allow operators to update harvesting capabilities without redeploying the primary payload.","timeline":[{"date":"2026-07-28","event":"Point Wild's Lat61 Threat Intelligence Team (researchers Prathamesh Shingare and Kedar Shashikant Pandit) published the primary technical dissection of Vanta Stealer, documenting its PyInstaller/PyArmor architecture, dynamic module retrieval, targeted data categories, exfiltration mechanism, and 20 SHA256 IOCs.","source":"Point Wild Threat Intelligence","source_url":"https://www.pointwild.com/threat-intelligence/point-wild-exclusive-dissecting-vanta-stealer-a-python-based-cross-platform-information-theft-malware/"},{"date":"2026-08-06","event":"Cyberpress published a report confirming Vanta Stealer distribution through cracked software, game cheating tools, and fake software update pages, corroborating the Point Wild findings.","source":"Cyberpress","source_url":"https://cyberpress.org/vanta-stealer-spreads-widely/"},{"date":"2026-08-06","event":"Rankiteo catalogued the threat with a severity rating of 85/100, noting the malware's targeting of Discord, Telegram, Roblox, and Minecraft alongside browser passwords and cryptocurrency wallets.","source":"Rankiteo Blog","source_url":"https://blog.rankiteo.com/mojtelrobdis1786019150-telegram-discord-roblox-minecraft-cyber-attack-august-2026/"},{"date":"2026-08-07","event":"PCRisk documented Vanta Stealer in its malware removal guide database, providing antivirus detection names across Avast, Combo Cleaner, Microsoft Defender, and Kaspersky, and listing suspected distribution vectors.","source":"PCRisk","source_url":"https://www.pcrisk.com/removal-guides/35704-vanta-stealer"},{"date":"2026-08-07","event":"GBHackers reported on Vanta Stealer's use of PyArmor obfuscation, its cross-platform Python base, and its targeting of browser passwords, crypto wallets, and Discord tokens.","source":"GBHackers","source_url":"https://gbhackers.com/vanta-stealer-uses-pyarmor/"},{"date":"2026-08-10","event":"CyberSecurityNews reported that Vanta Stealer empties browser vaults, crypto wallets, and gaming accounts, describing its speed of data extraction on compromised Windows systems.","source":"CyberSecurityNews","source_url":"https://cybersecuritynews.com/vanta-stealer-empties-browser-vaults/"},{"date":"2026-08-15","event":"HackRead published coverage confirming gamers, cryptocurrency users, and web application users as the primary target demographics, and detailing the malware's harvesting of Steam, Valorant, Roblox, and Minecraft accounts alongside wallet seed phrases.","source":"HackRead","source_url":"https://hackread.com/vanta-stealer-malware-gamers-crypto-users-web-apps/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 626ef01b-5275-4ea2-9f6e-1cb3aff64d82copy