CyberSpeak Lab Threat Watch - Vidar Stealer
CyberSpeak Labs Detection Intelligence Report
Research window includes data publicly posted from 2025 to 2026.
References: Picus Security, Splunk, Microsoft, and Malwarebytes
This report is intended to support and provide additional context around the emerging tactics and techniques identified in the recent Picus Security research. It incorporates additional research and publicly available threat intelligence to provide defenders with broader insight into the evolving threat landscape.
Disclaimer: Malware, threat actor behaviors, and security technologies continue to evolve rapidly. As a result, the information, indicators, techniques, and recommendations presented in this report may become outdated or change depending on how the malware or associated infrastructure is leveraged. Readers should validate findings against current threat intelligence and their organization's environment before using this information for detection, prevention, or response activities.
What is Vidar Malware
Vidar is a Malware as a Service (MaaS) information stealer that has been observed in the wild since 2018. The malware is commonly described as an Arkei Stealer copycat or derivative due to similarities in its code and functionality. Researchers have reported that Vidar shares code similarities with the original Arkei Stealer, which was also first observed in 2018.
Vidar primarily targets Windows systems and is designed to collect sensitive information from infected devices, thus rebranding the software as a generic malware to an infostealer. Recent variants have increasingly focused on credentials and authentication data stored within web browsers, including saved passwords, cookies, and, in some cases, active browser session information.
The information collected by Vidar can have consequences beyond the initial compromise. Stolen credentials and session data may be packaged and sold through criminal marketplaces, used for account takeover, or leveraged as initial access for additional malicious activity. As a result, a Vidar infection may serve as the starting point for a broader campaign rather than being the end objective itself. The malware's evolution and MaaS model also allow multiple threat actors and affiliates to leverage Vidar for their own campaigns, making it difficult to associate the malware exclusively with a single threat group and has great availability within the underground forums.
Below is a collected list of data that the infostealer has been identified to collect:
Data category | Examples |
Azure CLI (NEW - 2026) | Identity tokens, Microsoft Authentication Library (MSAL) token, and subscription data. |
Browser credentials | Chrome, Edge, Firefox, Opera, Vivaldi, Opera GX |
Session data | Browser cookies and authenticated sessions |
Autofill | Stored form information |
Financial data | Credit cards and banking credentials |
Cryptocurrency | Wallet files and browser wallet extensions |
Cloud credentials | AWS, Azure CLI, MSAL/token caches |
SSH/FTP | FileZilla, WinSCP |
Communications | Telegram, Discord |
Gaming | Steam authentication/session artifacts |
Local files | Documents and other targeted files |
Reconnaissance | Host information, installed software, processes |
Screenshots | Desktop screenshots |
Vidar Attack Chain
Depending on the version of Vidar that is purchased and leveraged, the attack chain can vary. Below is the newly seen one described in the article published by Picus Security:
Stage | Description | Tactics and Techniques |
Initial Access | Attackers use multiple methods to get the victim to a malicious site, download, or file. | Malvertising, SEO poisoning, phishing, compromised websites, software supply chain abuse. |
Lure / Delivery | Victims are directed toward fraudulent software or tools designed to appear legitimate. | Fake software installers, cracked applications, game cheats, AI tools, malicious browser extensions, or general ignorance. |
User Execution | The victim executes the downloaded file, installer, archive, or script. Social engineering may be used to convince the victim to bypass security warnings. | User Execution, malicious files, archive extraction, security warning bypass. |
Loader / Installer | A loader, archive, or package deploys and executes the next stage of the infection. Multiple stages may be used before Vidar executes. | Multi stage malware, loaders, installers, malicious packages. |
Defense Evasion / Anti Analysis | The malware attempts to avoid detection and make analysis more difficult before or during execution. | Obfuscation, packing, environment checks, anti debugging, anti virtualization, process injection, AMSI manipulation. |
Vidar 2.x Execution | Vidar executes on the Windows system and begins collecting sensitive information from the victim's device. | Browser: passwords, cookies, session data, autofill Cloud: AWS, Azure, MSAL data Local: files, application credentials, crypto wallets, system information, screenshots. |
Data Collection & Staging | Collected information is organized and prepared for transmission to the attacker. | Data aggregation, file collection, compression, temporary staging. |
C2 Resolution | Vidar may use services such as Telegram or Steam as dead drop resolvers to obtain information about its current command and control infrastructure. | Telegram/Steam dead drops, dynamic C2 resolution, rotating infrastructure. |
Command & Control | Vidar establishes communication with attacker controlled infrastructure. | HTTP/HTTPS, rotating IP addresses and domains, attacker controlled servers. |
Data Exfiltration | Stolen information is transmitted from the victim's system to attacker infrastructure. | HTTP POST, multipart/form data, encrypted communications. |
Attacker Objectives | Stolen information can be monetized or leveraged for additional malicious activity. | Credential sales, account takeover, financial fraud, initial access, lateral movement, ransomware, extortion. |
Detection Engineering Monitoring
Preventing applications from executing outside of approved program directories, such as %Temp%, %AppData%, and %Downloads%, can help prevent unauthorized applications like Vidar from executing from common user writable locations.
Additionally, organizations should use DNS filtering to block newly registered or suspicious domains. This can help prevent users from accessing newly established malicious websites, cracked software sites, and other domains commonly used to distribute malware.
Lastly, organizations should enforce Multi Factor Authentication (MFA) across all critical business and personal applications. Where possible, phishing resistant MFA should be used to provide stronger protection against stolen credentials and session based attacks.
Vidar needs to access browser databases containing credentials, cookies, and encryption material. Recommended to create rules based on Vidar's attack chain:
Detection / Behavior | What it is actually looking for | Why Vidar cares |
Browser Credential Store Access | A process other than the legitimate browser accessing files such as Login Data, Local State, Cookies, logins.json, or key4.db | Vidar searches these databases for saved passwords, cookies, encryption material, and other browser data |
Suspicious Process Location + Credential Access | A process running from locations such as %AppData%, %Temp%, %Downloads%, or %ProgramData% accessing browser credential files | Malware frequently executes from user writable locations rather than legitimate software directories |
Cloud Credential Theft | Processes accessing .aws, .azure, MSAL caches, accessTokens.json, TokenCache.dat, azureProfile.json, etc. | Vidar can collect cloud credentials and authentication material that may provide access beyond the infected endpoint |
Credential Store Sweep | One process accessing multiple credential stores within a short period | This is classic infostealer behavior: instead of stealing one credential, Vidar systematically searches for anything valuable |
Browser Process Injection | A non browser process injecting code into Chrome, Edge, Firefox, etc. | Vidar 2.x can interact with browser processes as part of credential/session theft |
Browser Memory Access | A suspicious process opening a handle to a browser and requesting memory access | Vidar can inspect browser memory to help bypass protections such as Chrome's App Bound Encryption |
Telegram / Steam Dead Drop | A machine accesses Telegram/Steam profile infrastructure and subsequently contacts an unusual external destination | Vidar can use legitimate services as a dead drop to obtain current C2 information |
HTTP Multipart Exfiltration | Outbound HTTP POST requests using multipart/form-data, particularly to unusual destinations | Vidar packages and sends stolen information back to attacker infrastructure |
Credential Access → Exfiltration | Credential/browser/cloud access followed shortly afterward by outbound network activity | The combination is much stronger evidence of an infostealer than either behavior by itself |
Registry Run Key Persistence | Creation/modification of HKCU\Software\Microsoft\Windows\CurrentVersion\Run entries, particularly pointing to suspicious files | Allows malware to execute again when the user logs in |
Scheduled Task Persistence | Creation of a scheduled task that launches an unusual executable or script | Provides persistence and potentially scheduled execution |
Startup Folder Persistence | New executable/shortcut placed in the Windows Startup directory | Causes malware to execute when the user logs in |
AMSI Modification | A process modifying amsi.dll or AmsiScanBuffer memory | Vidar has been observed attempting to weaken AMSI so security scanning cannot inspect its activity |
Large Padded Executable | Unusually large PE files containing significant amounts of padding/null bytes | Some Vidar loaders use massive files to evade automated malware sandboxes and file-size restrictions |
Untrusted/Fake Code Signing | An executable claims to be signed but has an invalid/untrusted certificate chain or suspicious signer | Attackers use certificates and legitimate-looking names to make malware appear trustworthy |
Known Vidar Hash | Exact SHA256/MD5/SHA1 match against a known Vidar sample | Identifies a known sample, but fails when attackers modify/rebuild the malware |
Known Vidar IP/Domain | Endpoint communicates with known Vidar infrastructure | Useful for blocking and enrichment, but weak against infrastructure rotation |
Public IOCs
Below is a list of composited IOCs. These IOCs are a collective list across media, social pages, and other news outlets. CyberSpeak Labs is not responsible if blocking any of the below IOCs can impact your organization. Please conduct your own checks to insure no legitmate processes are being blocked.
GTA 6 Campaign (Published by Malwarebytes)
Type | IOC |
Distribution | gta6demo[.]asia |
Distribution | gta6demo[.]eu |
Distribution | gta6demo[.]us |
Distribution | rockstar-gta-6[.]com |
Dead drop | telegram[.]me/m1duus |
Dead drop | t[.]me/m1duus |
Dead drop | pinterest[.]com/m1duus |
Dead drop | steamcommunity[.]com/profiles/76561198657426610 |
C2 | ses.1001gacor[.]org |
C2 | ket.sm188daftar[.]mom |
Additional infrastructure | ket.1001gacor[.]org |
Additional infrastructure | ljr.1001gacor[.]org |
Additional infrastructure | nhg.1001gacor[.]org |
Additional infrastructure | bob.1001gacor[.]org |
Additional infrastructure | kra.1001gacor[.]org |
Additional infrastructure | brr.1001gacor[.]org |
Additional infrastructure | sto.1001gacor[.]org |
Additional infrastructure | rex.1001gacor[.]org |
Additional infrastructure | bib.1001gacor[.]org |
Additional infrastructure | ges.1001gacor[.]org |
Additional infrastructure | tax.11gokil[.]org |
Additional infrastructure | sii.11gokil[.]org |
Additional infrastructure | zaf.11gokil[.]org |
Additional infrastructure | dez.11gokil[.]org |
Additional infrastructure | tax.sm188dnsx[.]top |
Additional infrastructure | sii.sm188dnsx[.]top |
Additional infrastructure | zaf.sm188dnsx[.]top |
Disney+ Impersonation Campaign
disneyplus[.]business
investtrad[.]com/Blue.mp4
www.frontier[.]net[.]pk/Brief_Disney.mp4
www.localmais[.]com[.]br/Disney_Full_Brief.mp4
squeakiekids[.]com/Brief_Disney.pdf
www.localmais[.]com[.]br/disney.pdf
dansorium[.]gr/DarkCyan-fa1d3_Install.exe
www.localmais[.]com[.]br/PlacedExotic.exe
File | SHA256 |
Brief_Disney.lnk | ad4931dedfb3060207f80e3e18df3fbef07a81dbe20dab667d5f14d2ac17136a |
BriefDisney.lnk | 4f8a50a9365d639c8384ec857c618a4f768b1ec6b677f5e79bd5d0eaaa579bcb |
BriefDisneyFull.lnk | 51cc8732ad424885e37b8d20f99faed9336e78a8a18590d61c64498eb4ec136e |
Disney_Full_Brief.lnk | 4d6ba4c3e0112fa8ad04153999086eecbe9ba33656a52c627a940650d086e877 |
Disney-Brief.lnk | 94d0a4eced73f3fabc66e650218274b35737bce94f6630b273487b1f3b13841e |
Blue.mp4 | 0ce235a306f30edff98fcbe045e7566c8e537fef7f5d094800927e2b1d5edc65 |
Brief_Disney.mp4 | 46a24124fa27c54512dd02bee6432d4f063d16224926eff268b5625ee258e174 |
Disney_Full_Brief.mp4 | 65325bda1aa8c53cde9f59733462154d702d440daead034c5130a78adef31aee |
DarkCyan-fa1d3_Install.exe | 660da1824c143de666903c2b3983df605a3494a9ddaa7b65919e1263b095e343 |
PlacedExotic.exe | e7fda5d2d6cc8971565ab7df08b6fe9417c307f692e0a2ef45f758f8092350ad |
Hashes Published
555fd5790046add4e994dfe655efe0ced7b31b73849793bd81bcff983f022013
b473b09292b0e9ed4d4089344f77a12465242cf69db10768c93ba6cd40cfe770
7073018596b174f584299d5152cf90f89a1f4e3bf072b778fc3342fda5c82f4f
8ca5069041a3de3536f0be3b8f1b9044a0dfffd0295d7495cbd57d6a312af0b5
06ba715b44892af143c4336c189c28b5d95f446d3d07ca7ce7a6ab2a0601168b
2fdcac512cef51c5b0d8a4fb23c278b973d20978aab5d463abbe131dd04879a0
c13be88a14d2c50b4e5ebca6b490fd6b8a6982555051c58b1d45fef6011671ee
8d5025b2ab7917dc3283738d91634a741d1bc3e03196d2855a1fd81fd9d80381
0a07b70b37919c01cfddd5e4b4260b144e138ac5
90657841d1dab058acc5292711047d2999b05df5
915456ad1037056f7b542db11a97011da74d710f
f6d6bf43990bde77af73d24f237c86889adacbfd
3ec44d141f4d08ada015759eb2c5c79d76b53c54
904eed155444a8ba021d2f6b1c1bb6c89cb739e7
3dd7b3bbb0dcfe89e1a3ff1c1b0abcd5371b706e
7df07eb1b7ba163c1a97b2120f15fdfb4bbc0cd6
f86db3e1c8635ecc820ef308302524bc
906010fce0c7b37b29ee13a78b6e130f
c45f291fda8740a843202a77180a15a1
240861bb6ee7723f0a7449ec501c466b
cf4866e9f6c60a4b253de4bb85f4da90
0a9a59c9e53e6d9f218fc6307016b44
7514a13877ee29b842859862663a03ed
057739a12fa0d25a1017e5f7a8538140
Collected Published and Tracked IPs
Published by SOCRadar, MalwareBazaar, Github, and other researchers on X and LInkedin.
91.202.233[.]214
46.151.182[.]205
67.219.102[.]244
221.207.101[.]175
77.83.36[.]163
101.200.193[.]211
162.248.225[.]165
109.73.193[.]242
15.204.95[.]228
129.150.46[.]86
5.101.86[.]98
5.101.86[.]105
178.16.54[.]248
115.231.236[.]150
167.86.72[.]220
206.188.196[.]221
172.245.195[.]206
88.119.167[.]143
83.98.39[.]54
84.21.189[.]225
89.23.107[.]148
89.23.113[.]207
116.203.165[.]124
116.202.184[.]145
138.199.246[.]13
116.203.243[.]208
136.243.203[.]111
Comments