Loading story…
A phishing campaign distributed the Vidar infostealer through .ISO attachments containing malicious Microsoft Compiled HTML Help (.CHM) files and a payload disguised as a Word document. Researchers said the infection chain used several nested stages to obscure execution—moving from ISO to CHM to HTA/JavaScript and finally to an executable—while making the lure appear benign to users. In observed samples, a file such as pss10r.chm silently relaunched through mshta and executed app.exe, which was identified as Vidar.
The malware used Vidar version 50.3 and retrieved command-and-control directions from Mastodon profile bios before downloading configuration data from C2 servers. Once active, it collected system information, browser and application passwords, and other sensitive data including payment details and cryptocurrency wallets, then exfiltrated the information in a ZIP archive. Researchers also reported that Vidar could download additional malware and remove created files afterward to reduce forensic evidence, underscoring the campaign's focus on stealth and credential theft.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
Trustwave said there was a notable increase in attackers using ISO files as malware containers beginning in 2019. This provides context for the delivery method used in the Vidar campaign.
The references state that Vidar was first seen in the wild in late 2018. It is described as a commercially sold infostealer and a variant of the earlier Arkei malware family.
The campaign analysis showed Vidar version 50.3 retrieving command-and-control directions from Mastodon profiles, then downloading configuration from C2 servers. Researchers also described how the CHM file was largely legitimate content with appended code that silently launched the malware.
Trustwave SpiderLabs reported a phishing/email campaign distributing the Vidar infostealer through an ISO attachment containing a malicious CHM help file disguised alongside a fake document. The infection chain used nested stages including CHM, HTA/JavaScript, and an executable payload to obscure execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
csoonline.com
Open sourcethreatpost.com
Open sourcetrustwave.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that updated **Vidar** infostealer campaigns are using steganography, fileless execution, and social-engineering lures to evade detection and steal corporate and consumer data. Point Wild and Intrinsec found infections delivered through fake GitHub repositories, compromised WordPress sites showing **ClickFix**-style fake CAPTCHA prompts, gaming cheat posts on Reddit and Discord, and bogus software promoted in YouTube videos and hosted on services such as Mediafire. In one chain, a fake tool named **NeoHub** dropped a malicious DLL disguised as a Microsoft Edge component and signed with counterfeit certificates impersonating GitHub and grow.com. The malware uses VBScript, obfuscated PowerShell, a Go-based loader, and trusted Windows binaries including `WScript`, `PowerShell`, and `RegAsm.exe` to fetch apparently harmless JPEG and TXT files that contain hidden Base64-encoded second-stage payloads, then reconstructs and executes them entirely in memory through .NET reflective loading. Researchers said Vidar now operates as a **Malware-as-a-Service** offering, uses Telegram and Dead Drop Resolver techniques via public Steam profiles to locate command-and-control infrastructure, and exfiltrates credentials, cookies, payment data, cryptocurrency wallet files, and information from more than 200 browser extensions, often through Telegram and Cloudflare-fronted domains to mask attacker activity.
Jun 29, 2026
Researchers and incident reports show the **Vidar** infostealer continuing to mature as a credential- and data-theft platform, with operators rotating backend infrastructure, tightening access to affiliate panels, and masking administration through **Tor relays**, **VPN services**, and hosting concentrated in Moldova and Russia. Team Cymru linked the operation to infrastructure including `my-odin[.]com` and several shifting IP addresses, while newer technical analysis found Vidar using multi-stage **PowerShell** delivery, process injection, API hooking, scheduled-task persistence, and theft of browser data by intercepting `CryptProtectMemory` before encryption. The malware targets Windows systems and steals credentials, cookies, autofill data, payment cards, crypto-wallet files, tokens, documents, and screenshots, then exfiltrates the data over encrypted channels. Campaigns tied to Vidar have used increasingly flexible command-and-control discovery and broad distribution channels. Analysts observed samples resolving C2 details dynamically through public profiles on **Faceit**, **Telegram**, and **Steam**, allowing operators to change infrastructure without rebuilding malware. Separate reporting tied Vidar to YouTube lures promoting cracked software and AI-generated tutorial videos, where victims were redirected to fake download sites that delivered stealer payloads. Earlier activity also showed Vidar deployed ahead of **GandCrab** ransomware, stealing victim data before downloading the encryptor, underscoring its role as both a standalone infostealer and a precursor for wider financially motivated intrusions.
Aug 28, 2026
Researchers analyzing multiple **Vidar Stealer** samples found the malware relies heavily on encrypted or XOR-obfuscated strings and dynamic API resolution to conceal its behavior. Reverse engineering with **Ghidra** and **x32dbg** exposed decrypted strings tied to `LoadLibraryA`, `GetProcAddress`, `VirtualAlloc`, anti-analysis checks, and broad data-theft functions. The recovered functionality shows Vidar harvesting browser passwords, cookies, autofill data, credit cards, Firefox/NSS secrets, FileZilla and WinSCP data, Steam files, Discord and Telegram artifacts, screenshots, host metadata, and numerous desktop and browser-extension cryptocurrency wallets. A separate campaign analysis showed Vidar configured to treat some stolen data differently when credentials were associated with hostnames linked to government, military, police, intelligence, CERT, and NATO-related organizations in Poland and the Baltic region. In that sample, the malware decrypted a hardcoded hostname list, checked stolen credentials for matches, and redirected matching data to an alternate command-and-control path, while command-and-control addresses were retrieved from Mastodon profiles including **@oleg98** and **@artemida**. The reporting also linked the broader activity to infrastructure or samples associated with **Raccoon**, **RedLine Stealer**, **SmokeLoader**, and **STOP ransomware**, indicating a wider criminal ecosystem around the campaign.
Aug 15, 2026