Vidar
- First seen
- 2018-10-01 00:00:00
- Malware type
- credential-stealer, spyware
- Family
- Malware family
- Related IoCs
- 9692 (8649 malicious)
- Last IoC activity
- 2026-10-17 04:15:04
- Profile updated
- 2026-07-07 12:41:02
Targeted industries: financial-services retail-and-hospitality technology-and-telecommunications
Context
Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.
Detection coverage
- 7 YARA rules
Detection rules
- ARTIFACTDROP_Go_Reflectiveloader_Decryption_Loop (yara-rule)
- SEKOIA_Infostealer_Win_Vidar_Strings_Nov23 (yara-rule)
- CAPE_Vidar (yara-rule)
- CAPE_Vidarold (yara-rule)
- SEKOIA_Infostealer_Win_Vidar_Str_Jul22 (yara-rule)
- RUSSIANPANDA_Vidar_DLL_Embedded (yara-rule)
- DITEKSHEN_MALWARE_Win_Vidar (yara-rule)
Reports & references
- CISA — Aa23 320A (report)
- intel471.com — Privateloader Malware (report)
- go.recordedfuture.com — Cta 2022 0802 (report)
- medium.com — Inside View Of Brazzzersff Infrastructure 89B9188Fd145 (report)
- info.spamhaus.com — 2023%20Q1%20Botnet%20Threat%20Update (report)
- info.spamhaus.com — 2023%20Q3%20Botnet%20Threat%20Update (report)
- spamhaus.org — Botnet Threat Update July To December 2025 (report)
- CrowdStrike — Report2020Crowdstrikeglobalthreatreport (report)
- cloud.google.com — Unc5537 Snowflake Data Theft Extortion (report)
- socprime.com — Somnia Malware Detection Uac 0118 Aka Frwl Launches Cyber Attacks Against Organizations In Ukraine Using Enhanced Malware Strains (report)
- CISA — Aa23 320A Scattered Spider (report)
- blog.sekoia.io — Exposing Fakebat Loader Distribution Methods And Adversary Infrastructure (report)
- bleepingcomputer.com — Gandcrab Operators Use Vidar Infostealer As A Forerunner (report)
- blog.malwarebytes.com — Vidar Gandcrab Stealer And Ransomware Combo Observed In The Wild (report)
- secureworks.com — The Growing Threat From Infostealers (report)
- elastic.co — Ghostpulse Haunts Victims Using Defense Evasion Bag O Tricks (report)
- insights.loaderinsight.agency — Vidar Build Id Correlation (report)
- blog.sekoia.io — Traffers A Deep Dive Into The Information Stealer Ecosystem (report)
- twitter.com — 1570821174736850945 (report)
- asec.ahnlab.com — 25837 (report)
- blog.cyble.com — Massive Youtube Campaign Targeting Over 100 Applications To Deliver Info Stealer (report)
- youtube.com — Watch (report)
- Trend Micro — Fake Installers Drop Malware And Open Doors For Opportunistic Attackers (report)
- malwarology.substack.com — Malicious Packer Pkr Ce1A (report)
- Trend Micro — Tiktok Videos Infostealers (report)