# jupiterha/ayhu-stealer architecture

> Architecture diagram of the GitHub repository jupiterha/ayhu-stealer, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-06-15). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/jupiterha/ayhu-stealer
- Repository: https://github.com/jupiterha/ayhu-stealer

## Overview

1. **Project shape**
   - This repository is essentially a **single-file Python stealer** centered in `Ayhu.py`.
   - There is no multi-service backend, no package structure, and no internal module boundary visible from the file tree.
   - The `img/` folder is documentation-only, used for screenshots in the README.

2. **Primary runtime**
   - The intended runtime is a **Windows desktop environment**.
   - That is implied by the targets it names: **Discord**, **Chrome**, and **Steam**, all of which require access to local user data stores and application directories.

3. **Core purpose**
   - The script’s purpose is **credential and session theft** plus basic host fingerprinting.
   - The README explicitly lists:
     - Discord tokens
     - Geolocation data
     - Chrome passwords and cookies across all profiles
     - Steam data

4. **Local data collection layer**
   - The first architectural boundary is the **local harvesting stage**.
   - It likely reads from:
     - browser profile storage for Chrome passwords/cookies
     - Discord-related local token/session artifacts
     - Steam client or related local files
   - This is all local-machine focused and does not appear to depend on any remote API beyond exfiltration.

5. **Host profiling / enrichment**
   - The “geolocation data” feature suggests a second stage that **enriches stolen data with IP-derived location metadata**.
   - This is typically used to add context to the stolen bundle before sending it out, rather than being a standalone user-facing feature.

6. **Exfiltration path**
   - The main outbound boundary is a **Discord webhook**.
   - The README instructs the operator to paste a webhook URL into `Ayhu.py`, which means the script is configured to **send collected data directly to Discord** rather than to a custom server.
   - That makes Discord the only explicit external service in the architecture.

7. **Operator configuration**
   - The script is manually customized by editing a placeholder webhook value in the source.
   - That means the repo has **no config system, no CLI, and no environment-based secret management**; configuration is embedded directly into the code.

8. **Packaging / delivery**
   - The README describes turning the script into an executable with **PyInstaller** or `auto_py_to_exe`.
   - Architecturally, this indicates the repo is designed for **single-binary distribution**, not for installation as a Python package or running as a long-lived service.

9. **Obfuscation and evasion**
   - The README claims obfuscation will make it “undetectable,” which suggests the operator expects the binary to be **obfuscated before distribution**.
   - This is part of the delivery/evasion layer, not the data collection logic itself.

10. **Data flow summary**
   - The effective flow is:
     - operator builds the script
     - victim executes the binary locally
     - the script gathers local credentials/tokens/cookies and host info
     - results are packaged and sent to a Discord webhook
   - There is no indication of persistence, command-and-control polling, or bidirectional tasking in the repo snapshot.

11. **Diagram boundary suggestion**
   - For an architecture diagram, model this as a **single Windows client executable** with three internal blocks:
     - local secret harvesting
     - host/location enrichment
     - webhook-based exfiltration
   - Surround it with an external dependency boundary for:
     - local browser/app data stores
     - Discord webhook endpoint
     - optional packaging tools used only at build time

12. **Notable absence**
   - There is no visible backend, database, queue, or API server in the repository.
   - So the architecture is **source script → packaged executable → direct webhook exfiltration**, with the repo itself acting as the entire implementation.

Main entry points: [`Ayhu.py`](https://github.com/jupiterha/ayhu-stealer/blob/main/Ayhu.py) (Ayhu.py), [`README.md`](https://github.com/jupiterha/ayhu-stealer/blob/main/README.md) (README), [`img`](https://github.com/jupiterha/ayhu-stealer/tree/main/img) (img)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_repo["Repository"]
  node_ayhu_py["Ayhu.py<br/>main script<br/>[Ayhu.py]"]
  node_readme_md["README<br/>docs<br/>[README.md]"]
  node_img_dir["img<br/>assets"]
end

subgraph group_runtime["Victim runtime"]
  node_operator_webhook["Webhook cfg<br/>embedded config<br/>[Ayhu.py]"]
  node_harvest["Harvesting<br/>collection stage<br/>[Ayhu.py]"]
  node_chrome_data[("Chrome data<br/>local browser store")]
  node_discord_data[("Discord data<br/>local app store")]
  node_steam_data[("Steam data<br/>local app store")]
  node_geo_enrich["Geo enrich<br/>profiling stage<br/>[Ayhu.py]"]
  node_package["Bundle<br/>payload assembly<br/>[Ayhu.py]"]
end

subgraph group_delivery["Build and delivery"]
  node_pyinstaller["PyInstaller<br/>packager"]
  node_autopy["auto_py_to_exe<br/>packager GUI"]
  node_obfuscation{{"Obfuscation<br/>evasion step"}}
end

subgraph group_external["External endpoints"]
  node_webhook(("Discord webhook<br/>exfil endpoint"))
end

node_readme_md -->|"documents"| node_ayhu_py
node_img_dir -->|"illustrates"| node_readme_md
node_ayhu_py -->|"reads config"| node_operator_webhook
node_ayhu_py -->|"runs"| node_harvest
node_harvest -->|"reads"| node_chrome_data
node_harvest -->|"reads"| node_discord_data
node_harvest -->|"reads"| node_steam_data
node_ayhu_py -->|"enriches"| node_geo_enrich
node_harvest -->|"feeds"| node_package
node_geo_enrich -->|"feeds"| node_package
node_package -->|"posts"| node_webhook
node_pyinstaller -.->|"builds"| node_ayhu_py
node_autopy -.->|"builds"| node_ayhu_py
node_obfuscation -.->|"masks"| node_ayhu_py

click node_ayhu_py "https://github.com/jupiterha/ayhu-stealer/blob/main/Ayhu.py"
click node_readme_md "https://github.com/jupiterha/ayhu-stealer/blob/main/README.md"
click node_img_dir "https://github.com/jupiterha/ayhu-stealer/tree/main/img"
click node_operator_webhook "https://github.com/jupiterha/ayhu-stealer/blob/main/Ayhu.py"
click node_harvest "https://github.com/jupiterha/ayhu-stealer/blob/main/Ayhu.py"
click node_geo_enrich "https://github.com/jupiterha/ayhu-stealer/blob/main/Ayhu.py"
click node_package "https://github.com/jupiterha/ayhu-stealer/blob/main/Ayhu.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_ayhu_py,node_readme_md,node_img_dir toneBlue
class node_operator_webhook,node_harvest,node_chrome_data,node_discord_data,node_steam_data,node_geo_enrich,node_package toneAmber
class node_pyinstaller,node_autopy,node_obfuscation toneMint
class node_webhook toneRose
```

## Components

### Repository

Source files and docs in this repo

- [Ayhu.py](https://github.com/jupiterha/ayhu-stealer/blob/main/Ayhu.py): main script · Single-file stealer entrypoint and orchestration logic · `Ayhu.py`
- [README](https://github.com/jupiterha/ayhu-stealer/blob/main/README.md): docs · Operator instructions, claims, and build notes · `README.md`
- [img](https://github.com/jupiterha/ayhu-stealer/tree/main/img): assets · Documentation images referenced by the README · `img`

### Victim runtime

Single Windows client executable and its local data targets

- [Webhook cfg](https://github.com/jupiterha/ayhu-stealer/blob/main/Ayhu.py): embedded config · Webhook URL placeholder edited directly in source · `Ayhu.py`
- [Harvesting](https://github.com/jupiterha/ayhu-stealer/blob/main/Ayhu.py): collection stage · Collects local credentials, tokens, cookies, and client data · `Ayhu.py`
- **Chrome data**: local browser store · Passwords and cookies across browser profiles
- **Discord data**: local app store · Token and session artifacts from the Discord client
- **Steam data**: local app store · Steam-related local files and client data
- [Geo enrich](https://github.com/jupiterha/ayhu-stealer/blob/main/Ayhu.py): profiling stage · Adds IP-derived location metadata to the stolen bundle · `Ayhu.py`
- [Bundle](https://github.com/jupiterha/ayhu-stealer/blob/main/Ayhu.py): payload assembly · Packages harvested data for outbound delivery · `Ayhu.py`

### Build and delivery

Tools and steps used to package and disguise the script

- **PyInstaller**: packager · Builds the script into a standalone executable
- **auto_py_to_exe**: packager GUI · Alternative tool for converting the script to an executable
- **Obfuscation**: evasion step · Optional source or binary obfuscation before distribution

### External endpoints

Remote service used for exfiltration

- **Discord webhook**: exfil endpoint · Direct outbound sink for collected data

## Connections

- README → Ayhu.py: documents · Explains how to edit and run the script
- img → README: illustrates · Screenshots and visual assets used in the documentation
- Ayhu.py → Webhook cfg: reads config · Uses the embedded webhook value set by the operator
- Ayhu.py → Harvesting: runs · Entry script coordinates local data collection
- Harvesting → Chrome data: reads · Pulls browser secrets and cookies from local stores
- Harvesting → Discord data: reads · Extracts Discord token and session artifacts
- Harvesting → Steam data: reads · Collects Steam-related local data
- Ayhu.py → Geo enrich: enriches · Adds geolocation context to collected data
- Harvesting → Bundle: feeds · Harvested artifacts are assembled for transport
- Geo enrich → Bundle: feeds · Location metadata is merged into the final bundle
- Bundle → Discord webhook: posts · Sends the final payload to Discord
- PyInstaller → Ayhu.py: builds · Packages the script into a standalone executable
- auto_py_to_exe → Ayhu.py: builds · Alternative executable packaging path
- Obfuscation → Ayhu.py: masks · Optional evasion step applied before distribution