Loading story…
Vidar infostealer versions 2.x and 3.x now use a lightweight bytecode virtual machine (VM) to conceal strings and, in some builds, derive key material for a second decryption stage. First observed in 2018, the malware has evolved from single-byte XOR obfuscation to modified ChaCha-based stream ciphers and VM-driven decryption designed to frustrate reverse engineering and static detection.
The VM uses a sparse 256-entry opcode dispatch table with 14 active handlers, a one-byte accumulator, the preceding output byte, and a build-specific four-byte XOR key. Vidar 2.0 and 2.1 use a modified ChaCha-derived cipher, while version 2.2 onward uses a custom add-rotate-XOR (ARX) stream cipher seeded with VM-decrypted key and nonce data; opcode mappings, constants, substitution tables, cipher seeds, and ARX operations vary by build, limiting the reliability of automated string recovery and static signatures.
Pull IOCs and campaign context straight into your stack.
7 events from the most recent confirmed update back to the earliest known activity.
During 2026, Vidar internal version 2.0 and later introduced a lightweight bytecode virtual machine and per-build custom stream ciphers for string protection. The VM can directly decode strings or recover key and nonce material for separately encrypted strings.
Vidar, an information-stealing malware family, was first observed. Early samples used single-byte XOR operations to obfuscate strings.
Vidar version 3.1 samples contained protected browser-discovery, wallet, plugin, grabber, loader-error, HWID-generation, and HTTP Accept-header strings. The samples demonstrate continued use of the VM and stream-cipher string-protection scheme.
Starting with version 2.2, Vidar replaced the modified ChaCha-based cipher with a custom add-rotate-XOR stream cipher. The cipher derives a 32-bit state from VM-decrypted key and nonce material and changes transformations and constants between builds.
Vidar versions 2.0 and 2.1 used VM-decoded key and nonce material with a modified ChaCha-based stream cipher, employing a custom 128-bit initial state, an eight-byte key, and a four-byte nonce.
Beginning with internal version 1.8, Vidar altered its ChaCha20 implementation to make detection and string decryption more difficult.
Vidar adopted ChaCha20-based string encryption beginning with internal version 1.5, replacing its earlier simple XOR string obfuscation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers analyzing multiple **Vidar Stealer** samples found the malware relies heavily on encrypted or XOR-obfuscated strings and dynamic API resolution to conceal its behavior. Reverse engineering with **Ghidra** and **x32dbg** exposed decrypted strings tied to `LoadLibraryA`, `GetProcAddress`, `VirtualAlloc`, anti-analysis checks, and broad data-theft functions. The recovered functionality shows Vidar harvesting browser passwords, cookies, autofill data, credit cards, Firefox/NSS secrets, FileZilla and WinSCP data, Steam files, Discord and Telegram artifacts, screenshots, host metadata, and numerous desktop and browser-extension cryptocurrency wallets. A separate campaign analysis showed Vidar configured to treat some stolen data differently when credentials were associated with hostnames linked to government, military, police, intelligence, CERT, and NATO-related organizations in Poland and the Baltic region. In that sample, the malware decrypted a hardcoded hostname list, checked stolen credentials for matches, and redirected matching data to an alternate command-and-control path, while command-and-control addresses were retrieved from Mastodon profiles including **@oleg98** and **@artemida**. The reporting also linked the broader activity to infrastructure or samples associated with **Raccoon**, **RedLine Stealer**, **SmokeLoader**, and **STOP ransomware**, indicating a wider criminal ecosystem around the campaign.
Aug 15, 2026A new strain of the Vidar infostealer is leveraging enhanced stealth, encrypted C2 channels, and sophisticated evasion tactics to target Windows environments. Researchers at Aryaka highlight its use of PowerShell obfuscation, AMSI bypass, and dynamic C2 retrieval from benign sources. Vidar's multipronged distribution and defense evasion pose significant risks to both individuals and enterprises.
Jun 29, 2026
Researchers and incident reports show the **Vidar** infostealer continuing to mature as a credential- and data-theft platform, with operators rotating backend infrastructure, tightening access to affiliate panels, and masking administration through **Tor relays**, **VPN services**, and hosting concentrated in Moldova and Russia. Team Cymru linked the operation to infrastructure including `my-odin[.]com` and several shifting IP addresses, while newer technical analysis found Vidar using multi-stage **PowerShell** delivery, process injection, API hooking, scheduled-task persistence, and theft of browser data by intercepting `CryptProtectMemory` before encryption. The malware targets Windows systems and steals credentials, cookies, autofill data, payment cards, crypto-wallet files, tokens, documents, and screenshots, then exfiltrates the data over encrypted channels. Campaigns tied to Vidar have used increasingly flexible command-and-control discovery and broad distribution channels. Analysts observed samples resolving C2 details dynamically through public profiles on **Faceit**, **Telegram**, and **Steam**, allowing operators to change infrastructure without rebuilding malware. Separate reporting tied Vidar to YouTube lures promoting cracked software and AI-generated tutorial videos, where victims were redirected to fake download sites that delivered stealer payloads. Earlier activity also showed Vidar deployed ahead of **GandCrab** ransomware, stealing victim data before downloading the encryptor, underscoring its role as both a standalone infostealer and a precursor for wider financially motivated intrusions.
Aug 28, 2026