New VVS Stealer Malware Targets Discord Accounts via Obfuscated Python Code

Summary

VVS Stealer is a newly observed Python‑based information stealer sold on Telegram. It is obfuscated with Pyarmor, packaged with PyInstaller and persists via the Windows Startup folder. The malware harvests Discord tokens, browser credentials, cookies, history, passwords and screenshots. It can also inject a malicious JavaScript payload to hijack active Discord sessions.

Investigation

Palo Alto Networks Unit 42 disclosed the malware, noting it has been offered for sale since April 2025. Researchers described its obfuscation technique, distribution model, and functionality including credential theft and Discord injection. The report links the tool to French‑speaking threat actors active in stealer‑focused Telegram groups.

Mitigation

Organizations should monitor for unknown PyInstaller executables and unexpected shortcuts in the Startup folder. Deploy endpoint detection rules for obfuscated Python scripts and suspicious JavaScript payloads. Enforce multi‑factor authentication for Discord and browser accounts and limit administrative privileges that could be abused for credential harvesting.

Response

If VVS Stealer is detected, isolate the affected endpoint, collect memory and file artifacts, and extract IOCs. Remove the malicious startup entry, terminate any injected Discord processes, and force a password reset for compromised accounts. Conduct a full forensic investigation to locate additional stolen credentials and ensure the remote C2 infrastructure is blocked.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands:
  The adversary has compromised a low‑privilege user account on a Windows workstation. Using a PowerShell dropper, they launch a malicious PyInstaller‑packed executable (VVS_Stealer.exe) that first spawns a process with the command line containing the string “PyInstaller”. The payload then forcibly terminates the running Discord client to prepare for a token‑stealing injection stage. All actions occur under the current user context, generating a single Process Creation event that matches the rule’s criteria.

  Step‑by‑step:

  1. Copy the malicious PyInstaller bundle to %TEMP%.
  2. Execute it with a command line that explicitly includes the word “PyInstaller”.
  3. The malicious binary internally calls taskkill /IM Discord.exe /F to terminate Discord.
  4. The termination generates a Process Creation event where the Image field resolves to the Discord executable path (C:Users<user>AppDataLocalDiscordapp-... Discord.exe) and the original spawn command line still contains “PyInstaller”.

• Regression Test Script: The following PowerShell script reproduces the exact telemetry needed to trigger the detection rule. It intentionally avoids any real malicious payload; instead, it launches a harmless notepad.exe process but pretends to be a PyInstaller‑packed executable by embedding the keyword in the command line. It also terminates any running Discord process to mirror the “Image endswith Discord.exe” condition.

  # -------------------------------------------------
  # Simulation Script – Triggers Sigma rule #f63685c4‑feea‑431b‑a749‑55cf8661e6ac
  # -------------------------------------------------
  
  # 1. Ensure Discord is running (optional, to guarantee termination)
  $discordPath = "$env:LOCALAPPDATADiscordapp-1.0.9005Discord.exe"
  if (-Not (Get-Process -Name "Discord" -ErrorAction SilentlyContinue)) {
      Start-Process -FilePath $discordPath -WindowStyle Hidden
      Start-Sleep -Seconds 5
  }
  
  # 2. Launch a dummy process with "PyInstaller" in its command line.
  #    Using notepad.exe as a benign placeholder.
  $dummyCmd = "C:WindowsSystem32notepad.exe"
  $cmdLine = "PyInstaller_dummy_execution -run $dummyCmd"
  Start-Process -FilePath $dummyCmd -ArgumentList $cmdLine -WindowStyle Hidden
  Write-Host "[+] Launched dummy process with PyInstaller keyword."
  
  # 3. Immediately terminate Discord to generate the Discord.exe image event.
  if (Get-Process -Name "Discord" -ErrorAction SilentlyContinue) {
      Stop-Process -Name "Discord" -Force
      Write-Host "[+] Discord.exe terminated."
  }
  
  # 4. Optional: Clean up the dummy notepad window after a short delay.
  Start-Sleep -Seconds 8
  Get-Process -Name "notepad" -ErrorAction SilentlyContinue | Stop-Process -Force
  Write-Host "[+] Cleanup completed."

• Cleanup Commands: Ensure no residual processes remain.

  # Remove any lingering dummy notepad processes
  Get-Process -Name "notepad" -ErrorAction SilentlyContinue | Stop-Process -Force
  
  # Restart Discord if needed for post‑test continuity
  $discordPath = "$env:LOCALAPPDATADiscordapp-1.0.9005Discord.exe"
  if (-Not (Get-Process -Name "Discord" -ErrorAction SilentlyContinue)) {
      Start-Process -FilePath $discordPath
      Write-Host "[+] Discord restarted for normal operations."
  }