Vidar Infostealer Evolved Evasion Tactics and Spread Through Gaming, YouTube, and Ransomware Chains
Researchers and incident reports show the **Vidar** infostealer continuing to mature as a credential- and data-theft platform, with operators rotating backend infrastructure, tightening access to affiliate panels, and masking administration through **Tor relays**, **VPN services**, and hosting concentrated in Moldova and Russia. Team Cymru linked the operation to infrastructure including `my-odin[.]com` and several shifting IP addresses, while newer technical analysis found Vidar using multi-stage **PowerShell** delivery, process injection, API hooking, scheduled-task persistence, and theft of browser data by intercepting `CryptProtectMemory` before encryption. The malware targets Windows systems and steals credentials, cookies, autofill data, payment cards, crypto-wallet files, tokens, documents, and screenshots, then exfiltrates the data over encrypted channels.
Campaigns tied to Vidar have used increasingly flexible command-and-control discovery and broad distribution channels. Analysts observed samples resolving C2 details dynamically through public profiles on **Faceit**, **Telegram**, and **Steam**, allowing operators to change infrastructure without rebuilding malware. Separate reporting tied Vidar to YouTube lures promoting cracked software and AI-generated tutorial videos, where victims were redirected to fake download sites that delivered stealer payloads. Earlier activity also showed Vidar deployed ahead of **GandCrab** ransomware, stealing victim data before downloading the encryptor, underscoring its role as both a standalone infostealer and a precursor for wider financially motivated intrusions.
Nov 22, 2023
Vidar Infostealer Uses JPEG/TXT Payload Hiding and Fake Software Lures
Researchers reported that updated **Vidar** infostealer campaigns are using steganography, fileless execution, and social-engineering lures to evade detection and steal corporate and consumer data. Point Wild and Intrinsec found infections delivered through fake GitHub repositories, compromised WordPress sites showing **ClickFix**-style fake CAPTCHA prompts, gaming cheat posts on Reddit and Discord, and bogus software promoted in YouTube videos and hosted on services such as Mediafire. In one chain, a fake tool named **NeoHub** dropped a malicious DLL disguised as a Microsoft Edge component and signed with counterfeit certificates impersonating GitHub and grow.com.
The malware uses VBScript, obfuscated PowerShell, a Go-based loader, and trusted Windows binaries including `WScript`, `PowerShell`, and `RegAsm.exe` to fetch apparently harmless JPEG and TXT files that contain hidden Base64-encoded second-stage payloads, then reconstructs and executes them entirely in memory through .NET reflective loading. Researchers said Vidar now operates as a **Malware-as-a-Service** offering, uses Telegram and Dead Drop Resolver techniques via public Steam profiles to locate command-and-control infrastructure, and exfiltrates credentials, cookies, payment data, cryptocurrency wallet files, and information from more than 200 browser extensions, often through Telegram and Cloudflare-fronted domains to mask attacker activity.
May 11, 2026
Vidar Infostealer Delivered Through ISO-Packaged Microsoft CHM Help Files
A phishing campaign distributed the **Vidar** infostealer through `.ISO` attachments containing malicious Microsoft Compiled HTML Help (`.CHM`) files and a payload disguised as a Word document. Researchers said the infection chain used several nested stages to obscure execution—moving from ISO to CHM to HTA/JavaScript and finally to an executable—while making the lure appear benign to users. In observed samples, a file such as `pss10r.chm` silently relaunched through `mshta` and executed `app.exe`, which was identified as Vidar.
The malware used **Vidar version 50.3** and retrieved command-and-control directions from **Mastodon** profile bios before downloading configuration data from C2 servers. Once active, it collected system information, browser and application passwords, and other sensitive data including payment details and cryptocurrency wallets, then exfiltrated the information in a ZIP archive. Researchers also reported that Vidar could download additional malware and remove created files afterward to reduce forensic evidence, underscoring the campaign's focus on stealth and credential theft.
Aug 14, 2026