Vanta Stealer: Python-Based Malware Leverages PyArmor Obfuscation for Cross-Platform Data Theft Researchers have identified Vanta Stealer, a sophisticated Python-based information stealer that targets Windows systems, employing layered obfuscation to evade detection and exfiltrate sensitive data. The malware, compiled with Visual Studio 2022 and packed using PyInstaller, embeds a Python runtime and modules into a single executable, complicating reverse engineering efforts. ### Key Features & Attack Chain Vanta Stealer employs PyArmor, a commercial code protection tool, to encrypt its payload, forcing analysts to bypass obfuscation before examining its logic. Once deobfuscated, the malware follows a modular, staged approach: 1. Collection – Dynamically retrieves browser credential extractors at runtime, reducing the need for full binary redistribution. 2. Targeted Theft – Harvests data from Discord, Telegram, Steam, Roblox, Minecraft, Riot/Valorant, Mullvad VPN, and cryptocurrency wallets, along with screenshots, webcam captures, and documents containing seed phrases or private keys. 3. Enrichment – Validates stolen Discord tokens via the Discord API, extracting usernames, emails, phone numbers, Nitro status, payment methods, and server admin privileges to prioritize high-value accounts. 4. Packaging & Exfiltration – Generates a Summary.txt report detailing compromised assets, then compresses all stolen data into a ZIP archive with metadata (victim ID, username, execution mode) before uploading to a hard-coded C2 server via HTTP POST. ### Evasion & Distribution Tactics - PyArmor obfuscation hinders static analysis, requiring specialized tools (e.g., PyArmor Static Unpack) to recover readable Python bytecode. - Modular design allows operators to update components (e.g., browser theft logic) without redistributing the full payload, evading signature-based detection. - Likely distributed via social engineering lures, including trojanized installers, cracked software, game cheats, fake updates, and malvertising, mirroring tactics used by similar stealers like VVS Stealer. ### Impact & Trends Vanta Stealer exemplifies the growing use of Python in malware development, combining commercial obfuscation tools, runtime module retrieval, and enriched victim profiling to maximize stolen data value. Its ability to dynamically adapt harvesting logic and prioritize high-value targets underscores the evolving sophistication of modern infostealers. Defenders are advised to monitor for suspicious PyInstaller executables and obfuscated Python artifacts as part of broader threat detection strategies.

Mac Users Targeted in ClickFix Campaign Delivering Atomic Stealer Malware A new ClickFix social engineering campaign is targeting macOS users, tricking victims into manually installing Atomic macOS Stealer (AMOS) malware by disguising malicious commands as routine verification steps. The attack begins when users encounter a fake CAPTCHA or error prompt on a compromised or fraudulent website, instructing them to copy a command, open Terminal, and execute it ostensibly to complete a security check. Unlike traditional exploits, this method relies on deception rather than software vulnerabilities, leveraging trust in familiar security prompts to coerce victims into executing the infection themselves. Once the command runs, it downloads a hidden disk image (DMG) containing Atomic Stealer, which operates stealthily mounting without visible indicators in Finder or on the desktop. The malware may then display a counterfeit macOS authentication dialog, tricking users into entering their password to grant elevated privileges. Atomic Stealer’s capabilities are extensive, targeting: - Browser data: Saved credentials, cookies, autofill details, and payment information from Chromium-based browsers (Chrome, Edge, Brave, Opera, etc.) and Firefox. - System credentials: Apple Keychain passwords, Safari cookies, and Apple Notes. - Messaging apps: Telegram and Discord desktop data, enabling attackers to impersonate victims or access sensitive communications. - Cryptocurrency assets: Desktop wallets (Exodus, Electrum, Atomic Wallet, Ledger, Trezor, etc.) and 200+ crypto-related browser extensions, with the ability to replace legitimate wallet apps with malicious versions. - Files: PDFs, TXT, and RTF documents. Stolen data is compressed into a ZIP archive and exfiltrated to an attacker-controlled server, where it can be used for account takeovers, financial theft, or follow-on scams. Kaspersky’s report highlights that ClickFix lures, previously focused on Windows users, are now expanding to macOS, employing tactics similar to a recent Script Editor campaign that also relied on social engineering. The attack’s effectiveness stems from bypassing technical defenses by exploiting user trust victims unknowingly authorize the malware’s installation and grant administrative access. Legitimate websites never require Terminal commands for verification, and macOS users are advised to treat unexpected password prompts with skepticism. The campaign underscores the growing threat of malware-as-a-service (MaaS) tools like Atomic Stealer, which lower the barrier for cybercriminals targeting Apple’s ecosystem.

Reddit, Discord Users Targeted in Social Engineering Scam Stealing Accounts A sophisticated social engineering scam is spreading across Reddit, Discord, and similar platforms, tricking users into handing over login or verification codes no malware or malicious links required. The attack begins with a direct message from a stranger, often claiming the recipient’s account was mistakenly reported or that the sender’s own account was flagged due to the user’s actions. Scammers maintain engagement by feigning innocence, avoiding arguments, and even asking victims for help "clearing things up." The next phase involves fake "proof" a fabricated email or Discord message posing as official Reddit correspondence, complete with a ticket number, legal threats, and a countdown to suspension. Some versions redirect victims to a fake Reddit moderator or employee on Discord. The final step is the request for a verification code. The scammer claims a Reddit "supervisor" needs it to confirm the victim’s innocence, then triggers a real login or recovery attempt. When Reddit sends the code to the victim, the scammer uses it to hijack the account, change the password, and lock out the owner. In some cases, victims are coerced into updating their account’s email to one controlled by the attacker, followed by extortion demands such as gift cards to avoid account deletion or misuse. Reddit’s official processes never involve direct contact between reported users or verification via unsolicited messages. Appeals are handled internally, with no detours to personal Discord accounts. The scam exploits urgency and trust, but basic precautions keeping verification codes private, refusing email changes for strangers, and enabling two-factor authentication can neutralize it. Users who lose access should rely on Reddit’s official recovery tools at reddit.com.

Discord Data Breach Notice Raises Validity Concerns A data breach notice filed with the Maine Attorney General’s office on June 8, 2026, names Discord Inc. as the affected company, claiming over 10 million individuals were impacted by "insider wrongdoing." However, multiple inconsistencies in the filing have raised doubts about its authenticity. The notice, submitted by an individual identified as a "Data Subject / Reporter" using a personal Gmail address and a placeholder phone number, differs from previous filings where Discord was represented by the law firm BakerHostetler. Key details are also missing, including the type of compromised data and an unusual consumer notification date of January 1, 2000. The reported breach timeline occurring on July 9, 2024, with discovery on August 2, 2025 further complicates the filing’s credibility. Discord’s most recent confirmed incident involved a third-party vendor breach in October 2025, where hackers stole government ID photos and private data from approximately 70,000 users. No official confirmation from Discord or regulators has been issued regarding the newly reported breach.

ARC Raiders Players Exposed to Privacy Risk via Discord Integration Flaw A security vulnerability in ARC Raiders, developed by Embark Studios, has exposed players’ private Discord data due to improper logging practices. Computer engineer Timothy D. Meadows reported that the game’s Discord integration was writing users’ private direct messages (DMs) and friends list activity in plaintext to a local log file, stored at `C:\Users\<username>\AppData\Local\PioneerGame\Saved\Logs`. While Meadows initially suggested the flaw could allow unauthorized message sending, he later corrected this, clarifying that the exposed Discord bearer token only granted access to modify voice settings not impersonate users. However, the logs still posed a significant privacy risk, as they could be accessed by other applications on the same machine or included in crash reports, potentially exposing private conversations to third parties. Meadows disclosed the issue publicly after Embark Studios failed to respond to his initial report a month prior. The developer later acknowledged the problem on its private Discord server, confirming that no data was transmitted outside users’ machines. Embark stated it had deployed a hotfix to disable excessive Discord SDK logging and was conducting a deeper audit. Players were advised to restart the game to apply the update. The incident highlights the risks of improper data handling in gaming integrations, particularly when sensitive third-party communications are logged without adequate safeguards.

Coinbase Confirms Insider Breach Impacting 30 Customers in December Incident Coinbase has disclosed an insider breach involving a contractor who improperly accessed the personal data of approximately 30 customers in December. The company confirmed the incident after threat actors known as Shiny Lapsus Hunters (SLH) briefly posted screenshots of an internal support interface on Telegram, revealing customer details such as names, email addresses, phone numbers, KYC information, wallet balances, and transaction histories. The contractor, who no longer works with Coinbase, was detected by the company’s security team last year. Affected users were notified and provided with identity theft protection services, while regulators were informed as part of standard protocol. This breach is unrelated to a separate January 2025 incident involving TaskUs, an outsourcing firm that provides support services to Coinbase. The screenshots shared by SLH suggest the group may have obtained the data through an insider or by circulating stolen information among threat actors. SLH has previously claimed to have bribed insiders at other firms, including CrowdStrike, to gain access to internal systems. Rising Threats to Business Process Outsourcing (BPO) Firms The incident highlights a growing trend of threat actors targeting BPO companies third-party firms handling customer support, IT services, and account management for organizations. Since BPO employees often have access to sensitive systems and data, they have become prime targets for attacks. Common tactics include: - Bribing insiders to steal or share customer information, as seen in the Coinbase and TaskUs breaches. - Social engineering support staff to gain unauthorized access, such as the Clorox breach, where attackers impersonated an employee to compromise a Cognizant help desk agent, leading to a $380 million lawsuit. - Compromising BPO employee accounts to access customer data, as in Discord’s October breach, where a support agent’s account at an outsourced provider was used to extract data from 5.5 million users. Recent attacks on retailers like Marks & Spencer and Co-op have also involved social engineering against support personnel, prompting the U.K. government to issue guidance on mitigating such threats. The shift toward targeting BPOs reflects a broader strategy by threat actors to exploit third-party access rather than directly breaching corporate networks.

Massive Discord Data Leak Claims Surface as Hackers Offer 78 Million Records A cybercriminal group known as HawkSec has claimed responsibility for a massive data leak involving Discord, alleging the theft of 78 million records from the platform’s servers. The attackers stated the database was compiled over several months as part of an internal project to develop a Discord intelligence platform, though they later abandoned the effort. The leaked data reportedly includes user profiles, voice session logs (207 million), files, and linked accounts such as Steam, raising concerns over potential doxxing, SWATing, impersonation, and account takeovers. While the group initially sought to sell the data, they later shifted their narrative, claiming they would share it with French authorities to combat illegal activities like CSAM, terrorism, and criminal networks. Despite the bold claims, cybersecurity researchers remain skeptical. The attackers have reuploaded their forum post multiple times, adding details about the operation’s leadership, yet they have not provided verifiable samples of the data. Discord, which has over 200 million active users, has faced previous issues with harassment and targeted attacks, making the alleged breach particularly concerning. The incident follows the emergence of Spy.Pet, a controversial tool that previously scraped billions of public Discord messages, offering them for AI training allegedly to federal agencies. HawkSec’s latest post suggests the breach extended beyond public servers, though the lack of evidence has led experts to question whether the leak is legitimate or an elaborate scam. Discord has not yet responded to requests for comment. The situation remains under scrutiny as security analysts assess the validity of the claims.

Discord experienced a security breach via a compromised third-party support vendor, exposing sensitive user data. Approximately 70,000 users had their government-issued ID photos accessed, while broader support-related data—including usernames, email addresses, partial billing metadata (last four digits of credit cards), IP addresses, and support conversation transcripts—was also exposed. Attackers exploited the breach to extort Discord for ransom, initially demanding $5 million before reducing it to $3.5 million. Though Discord denied the attackers' claims of stealing 1.6 TB of data (affecting ~5.5 million users), the incident highlights vulnerabilities in third-party vendor security. The breach did not compromise full credit card details, passwords, authentication tokens, or private messages beyond support interactions. Discord revoked the vendor’s access, launched an investigation, and notified affected users, but concerns remain over data retention policies and potential phishing risks for exposed users.

Shamis & Gentile P.A., one of the nation's premier class action law firms specializing in data breach cases, is investigating the Discord Inc. data breach. If you were affected by the data breach, your sensitive personally identifiable information may have been exposed, and you may be eligible for compensation. About Discord Inc. Founded in 2015, Discord started as a way for gamers to connect via text, voice and video chat, but it has since expanded to serve a wide variety of online communities. The platform allows users to create and manage servers, participate in real-time conversations and share content within interest-based groups. Discord is headquartered in San Francisco with nearly 2,000 employees and more than 150 million monthly active users worldwide,. What Happened? In late September 2025, Discord Inc. experienced a significant data breach. On Sept. 25, 2025, the company discovered that a third party had gained unauthorized access to its customer service platform through a compromised vendor device. The breach occurred between Sept. 20 and Sept. 22, 2025, before Discord was able to remove the unauthorized party from its systems. Consumer information exposed: Name Address Phone number Email address Discord username Date of birth Photo of driver’s license or other state or government-issued ID (if provided) Limited payment information (payment type, last four digits of credit card, Discord purchase or refund history) IP addresses Messages and attachm

Discord confirmed a security breach via a third-party customer support vendor (reportedly Zendesk), where an attacker compromised the support agent’s ticket queue, exposing sensitive user data. The stolen information includes names, Discord usernames, email addresses, contact details, support messages, partial billing data (last four digits of credit cards), and government-issued ID images (e.g., driver’s licenses, passports) submitted for age verification. The attacker, linked to the Scattered Lapsus$ Hunters group, demanded a ransom and threatened further leaks via their Data Leak Site (DLS). While Discord’s core systems remained unbreached, the incident heightens risks of identity theft, phishing, and financial fraud for affected users. The company revoked vendor access, launched forensics investigations, and cooperated with law enforcement but withheld key details like the breach duration, vendor name, and total impacted users. Previous attacks (e.g., Epsilon Red ransomware in July 2025) underscore Discord’s recurring vulnerabilities in third-party and platform security.

Discord, a widely used messaging platform, suffered a data breach in 2025 after a third-party customer service provider it relied on was hacked. The incident resulted in the unauthorized exposure of user data, with the compromised information carrying serious potential consequences. While the exact scope of the leaked data (e.g., personal details, account credentials, or communication logs) was not specified, the breach underscores the risks posed by supply-chain vulnerabilities—where even robust internal security measures can be undermined by external partners. The incident highlights how cybercriminals increasingly target third-party vendors as entry points to access larger organizations. Users were notified of the breach, though the long-term repercussions—such as identity theft, phishing attacks, or reputational damage to Discord—remain uncertain. The breach reinforces the need for stricter vendor security assessments and proactive monitoring of external dependencies in an era where digital supply-chain attacks are escalating.

Discord experienced a significant data breach via a third-party vendor, 5CA, a customer service provider. The breach exposed sensitive data of over 70,000 users, including names, emails, Discord usernames, IP addresses, customer support interactions, and government ID images used for age verification. The hacking group Scattered Lapsus$ Hunters (SLH) claimed responsibility, breaching 5CA’s support ticket environment and stealing 1.6 terabytes of data, including internal dashboards and payment information. While 5CA denied direct involvement, Discord confirmed the vendor was the initial attack vector. The breach poses severe risks, including identity theft, fraud, and phishing attacks, as criminals may exploit leaked government IDs and personal details. Users were advised to enable Multi-Factor Authentication (MFA), monitor credit reports, and remain vigilant against phishing attempts. The incident highlights vulnerabilities in supply-chain security, where third-party breaches can have cascading effects on primary organizations and their users.

Unverified Data Breach Notice Claims Discord Exposed Over 10 Million Users A data breach notice filed with the Maine Attorney General’s office on June 8, 2026, names Discord Inc. as the affected entity, alleging an "insider wrongdoing" incident impacting more than 10 million individuals. However, the filing contains multiple irregularities raising doubts about its legitimacy. The notice states the breach occurred on July 9, 2024, and was discovered over a year later, on August 2, 2025. It was submitted by an individual identified as Xavier Morrison, listed as a "Data Subject / Reporter," rather than a Discord legal or security representative. The provided contact details a placeholder phone number and a personal Gmail address further undermine its credibility. Key details remain unclear or inconsistent. The filing does not specify which personal data was exposed beyond "name or other personal identifier," and the consumer notification date is listed as January 1, 2000, a date misaligned with the reported timeline. Additionally, no identity theft protection services were offered, and the notice lacks a copy of the communication sent to affected Maine residents. Discord’s most recent confirmed breach occurred in October 2025, when hackers stole government ID photos and private data of approximately 70,000 users via a third-party vendor. A 2023 filing reported 180 victims from another third-party breach. Given the discrepancies including the reporter’s role, missing documentation, and unusual timestamps the notice should be treated as an unverified claim rather than confirmed evidence of a breach. Discord has not publicly acknowledged the incident, and no official statement has been issued. The Maine Attorney General’s portal, while a public reporting tool, does not independently verify submissions. Discord has been contacted for comment.

A data breach at Discord occurred due to a compromised third-party customer support vendor, exposing sensitive user information over a two-week period before detection. The attackers accessed Discord’s ticketing system, stealing data such as email addresses, usernames, IP addresses, support ticket contents (including personal disputes and verification processes), and—critically—scanned government-issued IDs submitted for age verification. While passwords and payment details remained secure, the leaked data (including limited billing details and support chat histories) heightens risks of targeted phishing, identity theft, and reputational harm. The breach was confined to users who interacted with support during the exposure window, though the exact scale remains undisclosed. This incident follows a similar 2023 third-party compromise affecting ~200 accounts, underscoring persistent supply-chain vulnerabilities in Discord’s ecosystem. The company severed the vendor’s access and launched an investigation, but critics argue reactive measures are insufficient without broader reforms like zero-trust architectures or public vendor audits. Affected users are advised to enable two-factor authentication and monitor for fraud.

Popular VoIP and social messaging company Discord has announced a data breach and is alerting the affected users. The security compromise caused unauthorized entry into a third-party customer care agent's support ticket queue. The support ticket queue contained user email addresses, messages, and related attachments exchanged with Discord support. The business quickly deleted the hacked account and investigated the affected computer to see if the malware had been installed. Discord also disclosed that it had collaborated with its customer support partner to strengthen its cybersecurity posture and avoid repeating the same mistakes.

The Maine Office of the Attorney General reported a data breach involving Discord Inc. on August 21, 2023. The breach occurred on March 29, 2023, when an unauthorized individual accessed a third-party service provider's agent account, potentially exposing the personal information of one Maine resident, specifically their driver's license number. However, a total of 180 individuals were affected.

Actors stole people’s accounts on Discord by pushing modifying trojans into them. The attackers took over the accounts and then dispense the malware to the victim’s friends. The malware turned the Discord client into a dangerous piece of software by modifying its regular JavaScript files. The filenames gave away the role of these JavaScript snippets, but the victims were unlikely to check these manually anyway.

A group of hackers published a list of email addresses and passwords they say they phished from users of the gaming chat platform Discord. The list was small, totaling in at only around 2,500 logins, but the news still acts as a reminder that Discord users need to remain vigilant against phishing. This was no virus, worm, or malware of any sort it was a simple old phishing site that utilized Discord's moronic API to hijack these accounts. Along with their message, the hackers posted a database of the allegedly phished credentials, split into multiple sections of those that work and those that don't.