Loading story…
Researchers reported that updated Vidar infostealer campaigns are using steganography, fileless execution, and social-engineering lures to evade detection and steal corporate and consumer data. Point Wild and Intrinsec found infections delivered through fake GitHub repositories, compromised WordPress sites showing ClickFix-style fake CAPTCHA prompts, gaming cheat posts on Reddit and Discord, and bogus software promoted in YouTube videos and hosted on services such as Mediafire. In one chain, a fake tool named NeoHub dropped a malicious DLL disguised as a Microsoft Edge component and signed with counterfeit certificates impersonating GitHub and grow.com.
The malware uses VBScript, obfuscated PowerShell, a Go-based loader, and trusted Windows binaries including WScript, PowerShell, and RegAsm.exe to fetch apparently harmless JPEG and TXT files that contain hidden Base64-encoded second-stage payloads, then reconstructs and executes them entirely in memory through .NET reflective loading. Researchers said Vidar now operates as a Malware-as-a-Service offering, uses Telegram and Dead Drop Resolver techniques via public Steam profiles to locate command-and-control infrastructure, and exfiltrates credentials, cookies, payment data, cryptocurrency wallet files, and information from more than 200 browser extensions, often through Telegram and Cloudflare-fronted domains to mask attacker activity.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
LevelBlue researchers reported a multi-stage Vidar campaign using a fake software activation tool, MicrosoftToolkit.exe, to deliver the infostealer. The chain used renamed scripts, staged payload extraction, an AutoIt-compiled loader, anti-analysis checks, and post-execution cleanup, while Vidar stole browser credentials, cookies, cryptocurrency wallet files, and system data.
Point Wild's Lat61 Threat Intelligence Team analyzed the 2026 variant and found it used VBScript, obfuscated PowerShell, a Go-based loader, RegAsm.exe, and .NET reflective loading for in-memory execution. The approach minimized disk artifacts and helped the malware evade detection while stealing credentials, wallet data, and browser-extension secrets.
Researchers reported a 2026 campaign distributing Vidar through fake GitHub repositories, gaming cheat lures shared on Discord and Reddit, and ClickFix-style fake CAPTCHA pages on compromised WordPress sites. These social-engineering vectors were used to trigger the malware's staged execution chain.
In 2026, researchers identified a Vidar variant that concealed Base64-encoded second-stage payload data inside seemingly benign JPEG and TXT files. The files were retrieved during a multi-stage infection chain and used to reconstruct the payload while reducing obvious malicious artifacts.
Intrinsec documented an infection chain in which Vidar used a malicious DLL disguised as a Microsoft Edge component and signed with counterfeit certificates impersonating GitHub and grow.com. The malware used a Dead Drop Resolver via public Steam profiles and Telegram channels to locate command-and-control infrastructure dynamically.
In early 2026, a Vidar campaign targeted corporate employees with fake software downloads advertised in YouTube videos and hosted on file-sharing services such as Mediafire. One documented lure used a fake tool called NeoHub to deliver the malware.
In October 2025, Vidar 2.0 was released, adding improved capabilities and stronger evasion. Subsequent reporting says it became one of the top stealers sold on Russian Market.
Law enforcement actions in 2025 disrupted the Lumma and Rhadamanthys infostealer ecosystems. Reporting says Vidar's rise accelerated afterward as operators and buyers shifted toward alternative stealers.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcescworld.com
Open sourcedarkreading.com
Open sourcecybersecuritynews.com
Open sourcehackread.com
Open sourcecybersecuritynews.com
Open sourcepointwild.com
Open sourceacronis.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers documented several **multi-stage malware campaigns** that used phishing lures, fake software updates, and DLL sideloading to deploy credential theft and remote access payloads. In one June 2026 intrusion targeting a small number of German financial institutions, a spear-phishing email posing as an urgent VPN update delivered a 7-Zip self-extracting archive that dropped a signed copy of **Radmin VPN** alongside a trojanized `Qt5Core.dll`, launching **HijackLoader** and ultimately **Vidar v2.1** through process hollowing into a signed `dBpoweramp` binary. A parallel chain used Opera sideloading to install **SnappyClient RAT**. Separate reporting also described a targeted Spanish-language phishing lure that delivered a password-protected archive containing a .NET loader and a byte-reversed DLL payload, as well as a fake browser update chain that used a signed **G DATA AntiVirus** binary to sideload **PlugX** linked to suspected **Mustang Panda** activity. Across the cases, the malware families showed strong emphasis on **credential theft, stealth, and layered execution**. Vidar samples were observed harvesting browser passwords, cookies, screenshots, FileZilla and WinSCP data, and cryptocurrency wallet information, while also bypassing Chromium App-Bound Encryption by launching legitimate Chrome and Edge instances with specific flags and using dead-drop resolvers such as **Steam** and **Telegram** to locate command-and-control servers. The PlugX implant used multiple decoding and encryption layers, manual PE mapping, registry-based persistence, and WinHTTP communications to `fruitbrat[.]com:443`, while another credential-stealing sample tied in open sources to **RedFoxtrot** targeted Firefox and Internet Explorer data and used proxy-aware HTTP communications with hardcoded infrastructure. The reporting highlights continued attacker reliance on signed binaries, staged loaders, and obfuscated payload handling to evade detection while stealing credentials and enabling follow-on access.
Jul 12, 2026
Attackers are using TikTok and Instagram Reels to distribute **Vidar** infostealer through polished short videos that impersonate trusted brands and promise free access to premium software such as Spotify Premium and Microsoft Word. Reporting citing ReversingLabs says the clips use tutorial-style content, AI-generated voiceovers, and engagement bait to persuade users either to visit malicious download pages or to paste terminal and PowerShell commands that silently retrieve and run the malware. The campaign replaces traditional phishing emails with social media-driven social engineering and benefits from recommendation algorithms and weak moderation, with one tracked video reportedly surpassing 109,000 views. **Vidar**, a malware-as-a-service infostealer, can steal passwords, banking data, browser cookies, credentials, and session tokens, while researchers said attacker accounts were able to evade reporting, delete warning comments, and block users who raised concerns. Defenders were urged to treat social platforms as an active malware delivery channel, restrict software installation rights, and train users not to execute untrusted commands from online videos.
Jun 29, 2026
Security researchers reported two malware campaigns using fake or trojanized software downloads to install remote access trojans with credential theft and persistence features. eSentire identified a previously undocumented **STX RAT** after an attempted intrusion against a finance-sector organization, where a browser-downloaded VBScript launched a multi-stage loader chain using **XXTEA** and **Zlib** unpacking, anti-analysis checks, and several persistence methods. The malware supports **HVNC**, in-memory payload execution, tunneling, screenshots, security-tool inventory, and theft of browser credentials, cookies, Windows Vault data, FTP client secrets, and cryptocurrency wallets. Its command-and-control design uses **X25519 ECDH**, **Ed25519**, **HKDF-SHA256**, and **ChaCha20-Poly1305** over a custom TCP protocol, with infrastructure reachable over both the clear web and **Tor**. A separate investigation by Breakglass Intelligence found a fake software keygen packaged as a malicious WinRAR self-extracting archive that deployed the **Vjw0rm** JavaScript RAT through a four-layer dropper chain. The infection used nested SFX archives, a compiled AutoHotkey loader, parallel payload paths, and three persistence mechanisms, while abusing `upaste[.]me` as a dead-drop service and hiding the RAT as an XML file later renamed to JavaScript for execution. Researchers said the operator appeared to be a Turkish-speaking commodity cybercrime actor relying on reused tooling, deceptive file paths, and bundled legitimate Windows files to evade detection, underscoring how software cracks, keygens, and trojanized installers remain effective delivery vectors for RATs and infostealers.
Jun 29, 2026