Threat Summary
A new OTX pulse published by AlienVault (TLP:WHITE, modified 2026-09-22), sourced from Zscaler ThreatLabz research, documents a significant evolution in the Vidar information stealer's anti-analysis capabilities. Between May and September 2026, Vidar's operators iterated through three distinct string obfuscation generations: basic XOR encryption, then ChaCha20-based algorithms, and most recently a custom virtual machine executed via a lightweight bytecode interpreter paired with custom ARX-based stream ciphers.
This progression matters because Vidar's entire post-exploitation logic — C2 addresses, targeted browser paths, wallet locations, and exfiltration endpoints — lives inside obfuscated strings. By moving decryption into a bespoke VM, the operators have effectively blinded static analysis pipelines, automated sandbox string extraction, and a large class of signature-based detection that relied on recovering plaintext indicators from the binary.
The campaign objective is unchanged but amplified: bulk credential harvesting (browser cookies, saved passwords, autofill data), cryptocurrency wallet theft, and session token exfiltration, with stolen data feeding dark web credential marketplaces and initial access broker pipelines. Organizations should treat any Vidar detection as a full identity compromise event for the affected user, not merely a malware incident.
Threat Actor / Malware Profile
Malware Family: Vidar (first observed 2018) Attribution: Unknown — operated as Malware-as-a-Service, sold and rented through underground forums Classification: Infostealer / Credential Harvester
Distribution Method: Vidar is typically delivered via malvertising, cracked software and keygen sites, malicious SEO poisoning, phishing attachments, and bundled loaders. Its MaaS model means distribution TTPs vary by affiliate.
Payload Behavior:
- Harvests credentials from Chromium- and Gecko-based browsers (cookies, saved logins, autofill, credit cards)
- Targets cryptocurrency wallet extensions and desktop wallet files
- Steals FTP/VPN client credentials, Telegram sessions, and OS credentials
- Stages stolen data into a ZIP archive in memory or temp directories before exfiltration
C2 Communication:
- HTTP/HTTPS POST-based exfiltration to hardcoded C2 infrastructure
- Historically abused legitimate platforms (Telegram, Steam profiles, Mastodon) as dead-drop resolvers for dynamic C2 configuration
- C2 addresses are now encrypted inside the VM-protected string table, meaning network indicators must be recovered dynamically
Persistence Mechanism: Vidar is generally smash-and-grab (execute, steal, exit, self-delete), but affiliate loaders may establish Run-key or scheduled-task persistence for the delivery chain.
Anti-Analysis Techniques (the core of this pulse):
- Generation 1 (May 2026): XOR-based string encryption
- Generation 2: ChaCha20-based string decryption routines
- Generation 3 (current): Custom virtual machine with a lightweight bytecode interpreter; strings are decrypted by executing embedded bytecode programs, combined with custom ARX (Add-Rotate-XOR) stream ciphers — defeating static string extraction, YARA plaintext matching, and most sandbox reports
IOC Analysis
This pulse contains 8 file hash indicators (3× SHA256, 3× MD5, 2× SHA1) representing current Vidar samples implementing the VM-based obfuscation. No network IOCs (IPs, domains, URLs) were published in this pulse — which is itself the point: network indicators are now VM-encrypted inside the binaries and cannot be statically extracted.
Operationalization guidance for SOC teams:
- Ingest all hashes into your EDR blocklist and threat intelligence platform immediately. Hash matching remains the fastest confirmed-detection path even against obfuscated binaries.
- Treat hash-only pulses as behavioral-detection triggers. Since Vidar's C2 strings are no longer statically recoverable, shift detection weight to behavior: browser credential store access, rapid file enumeration, ZIP staging, and anomalous outbound POSTs from unsigned binaries.
- Tooling for decoding: Zscaler's reference research provides the VM bytecode structure — analysts can use IDA Pro/Ghidra with scripted emulation (e.g., Qiling, Unicorn engine, or Flare-Emu) to execute the bytecode interpreter and recover decrypted strings. Sandboxes with dynamic string capture (any.run, Joe Sandbox, VMRay) remain effective because decryption happens at runtime.
- Retro-hunt the SHA256 values across proxy, EDR, and mail gateway telemetry for the past 90 days — samples circulate in MaaS channels before pulses publish.
Detection Engineering
The Sigma rules below target Vidar's behavioral execution patterns that survive its string obfuscation: browser credential store access by non-browser processes, infostealer staging behavior, and suspicious temp-directory execution.
YAML
---
title: Vidar Infostealer - Browser Credential Store Access by Non-Browser Process
description: Detects non-browser processes accessing browser credential stores (Login Data, Cookies, Web Data, key4.db), a hallmark of Vidar infostealer credential harvesting regardless of string obfuscation level.
author: Security Arsenal Threat Intelligence
status: experimental
logsource:
category: file_event
product: windows
definition: sysmon
detection: selection
level: high
tags:
- attack.credential_access
- attack.t1555.003
- attack.t1539
references:
- https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation
date: 2026/09/22
detection:
selection_files:
TargetFilename|contains:
- '\AppData\Local\Google\Chrome\User Data\'
- '\AppData\Local\Microsoft\Edge\User Data\'
- '\AppData\Roaming\Mozilla\Firefox\Profiles\'
- '\AppData\Local\BraveSoftware\'
selection_objects:
TargetFilename|endswith:
- '\Login Data'
- '\Cookies'
- '\Web Data'
- '\Local State'
- 'key4.db'
- 'logins.json'
filter_browsers:
Image|contains:
- '\chrome.exe'
- '\msedge.exe'
- '\firefox.exe'
- '\brave.exe'
condition: selection_files and selection_objects and not filter_browsers
falsepositives:
- Password managers with browser integration
- Enterprise backup agents
---
title: Vidar Infostealer - Execution from Temp or AppData with Credential Access Behavior
description: Detects unsigned or short-lived executables launched from Temp/AppData directories spawning data-staging behavior consistent with Vidar smash-and-grab execution chain.
author: Security Arsenal Threat Intelligence
status: experimental
logsource:
category: process_creation
product: windows
level: high
tags:
- attack.execution
- attack.t1059
- attack.t1027
- attack.t1560.001
references:
- https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation
date: 2026/09/22
detection:
selection_path:
Image|contains:
- '\AppData\Local\Temp\'
- '\AppData\Roaming\'
- '\ProgramData\'
- '\Users\Public\'
selection_unsigned_or_random:
Image|endswith: '.exe'
filter_known:
Image|contains:
- '\Microsoft\'
- '\Google\Update\'
condition: selection_path and selection_unsigned_or_random and not filter_known
falsepositives:
- Software installers and updaters
- IT deployment tooling
---
title: Vidar Infostealer - Known Sample Hash Execution
description: Detects execution of Vidar samples published in OTX pulse covering VM-based string obfuscation variants observed May-September 2026.
author: Security Arsenal Threat Intelligence
status: experimental
logsource:
category: process_creation
product: windows
level: critical
tags:
- attack.credential_access
- attack.t1555
- attack.exfiltration
- attack.t1041
references:
- https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation
date: 2026/09/22
detection:
selection_sha256:
Hashes|contains:
- 'SHA256=2d43d592630ad1e012da63ef7279f95dd4a8e94964e12ca2f996051875574fa6'
- 'SHA256=979048a749d8f28d877c7068b1b336ecd1e349869dfb1d7c68118f90e4099bc4'
selection_md5_sha1:
Hashes|contains:
- 'MD5=16addb6524e5cf76f4114b0979f715ff'
- 'MD5=03f13619a413dd1bd7ff8dd47687b3e9'
- 'MD5=a2535f051c329131c107d14651ace793'
- 'SHA1=91c3431e51158aa800a452222a2404d7b82631ea'
- 'SHA1=37ee3afa9df9c7d65b780cf54e908a98b92c4a5b'
- 'SHA1=eb2a38a90d20475b00bdc285b89eb50eefd0b88e'
condition: 1 of selection_*
falsepositives:
- None expected
KQL — Microsoft Sentinel / Defender
// Vidar Infostealer Hunt - credential store access + hash matching + temp execution
// Microsoft Sentinel / Microsoft 365 Defender
let VidarHashes = dynamic([
"2d43d592630ad1e012da63ef7279f95dd4a8e94964e12ca2f996051875574fa6",
"979048a749d8f28d877c7068b1b336ecd1e349869dfb1d7c68118f90e4099bc4",
"16addb6524e5cf76f4114b0979f715ff",
"03f13619a413dd1bd7ff8dd47687b3e9",
"a2535f051c329131c107d14651ace793",
"91c3431e51158aa800a452222a2404d7b82631ea",
"37ee3afa9df9c7d65b780cf54e908a98b92c4a5b",
"eb2a38a90d20475b00bdc285b89eb50eefd0b88e"
]);
let BrowserProc = dynamic(["chrome.exe","msedge.exe","firefox.exe","brave.exe","opera.exe"]);
// Stage 1: Hash match on known Vidar samples
let HashHits = DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where SHA256 in~ (VidarHashes) or MD5 in~ (VidarHashes) or SHA1 in~ (VidarHashes)
| project HashHitTime=TimeGenerated, DeviceName, AccountName, FileName, FolderPath, SHA256, MD5;
// Stage 2: Non-browser process touching browser credential stores
let CredStoreAccess = DeviceFileEvents
| where TimeGenerated > ago(14d)
| where FolderPath has_any ("Login Data", "Web Data", "Cookies", "Local State", "key4.db", "logins.json")
| where FolderPath has_any ("Chrome\\User Data", "Edge\\User Data", "Firefox\\Profiles", "BraveSoftware")
| where not(InitiatingProcessFileName in~ (BrowserProc))
| summarize FileHits=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated)
by DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessSHA256;
// Stage 3: Outbound connections from unsigned binaries in user-writable paths
let SuspiciousNet = DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFolderPath has_any ("\\Temp\\", "\\AppData\\Roaming\\", "\\Users\\Public\\")
| where RemotePort in (80, 443, 8080)
| where ActionType == "ConnectionSuccess"
| summarize Connections=count(), RemoteIPs=make_set(RemoteIP), FirstSeen=min(TimeGenerated)
by DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath;
union HashHits,
(CredStoreAccess | project-rename HashHitTime=FirstSeen | extend FileName=InitiatingProcessFileName, FolderPath=InitiatingProcessFolderPath, SHA256=InitiatingProcessSHA256, AccountName="", MD5="" | project HashHitTime, DeviceName, AccountName, FileName, FolderPath, SHA256, MD5)
| summarize arg_max(HashHitTime, *) by DeviceName, FileName
| join kind=leftouter (SuspiciousNet) on DeviceName
| project DeviceName, FileName, FolderPath, SHA256, HashHitTime, RemoteIPs, Connections
| order by HashHitTime desc
PowerShell
# Vidar Infostealer IOC & Artifact Hunt - Security Arsenal
# Run elevated on suspect endpoints or deploy fleet-wide via RMM/SCCM
# Checks: known hashes, temp/AppData droppers, browser staging artifacts, Run-key persistence
$ErrorActionPreference = 'SilentlyContinue'
$report = @()
$vidarHashes = @(
'2d43d592630ad1e012da63ef7279f95dd4a8e94964e12ca2f996051875574fa6',
'979048a749d8f28d877c7068b1b336ecd1e349869dfb1d7c68118f90e4099bc4',
'16addb6524e5cf76f4114b0979f715ff',
'03f13619a413dd1bd7ff8dd47687b3e9',
'a2535f051c329131c107d14651ace793',
'91c3431e51158aa800a452222a2404d7b82631ea',
'37ee3afa9df9c7d65b780cf54e908a98b92c4a5b',
'eb2a38a90d20475b00bdc285b89eb50eefd0b88e'
)
Write-Host "[*] Phase 1: Hash sweep of user-writable directories..." -ForegroundColor Cyan
$searchPaths = @("$env:TEMP", "$env:LOCALAPPDATA\Temp", "$env:APPDATA", "C:\Users\Public", "C:\ProgramData")
foreach ($path in $searchPaths) {
Get-ChildItem -Path $path -Recurse -File -Include *.exe,*.dll -ErrorAction SilentlyContinue | ForEach-Object {
$h = Get-FileHash -Path $_.FullName -Algorithm SHA256
$m = Get-FileHash -Path $_.FullName -Algorithm MD5
if ($vidarHashes -contains $h.Hash.ToLower() -or $vidarHashes -contains $m.Hash.ToLower()) {
$report += [PSCustomObject]@{Type='HASH_MATCH'; Path=$_.FullName; SHA256=$h.Hash; Detail='CONFIRMED VIDAR SAMPLE'}
Write-Host "[!] CONFIRMED VIDAR HASH: $($_.FullName)" -ForegroundColor Red
}
}
}
Write-Host "[*] Phase 2: Recent unsigned executables in Temp/AppData (last 14 days)..." -ForegroundColor Cyan
$cutoff = (Get-Date).AddDays(-14)
foreach ($path in $searchPaths) {
Get-ChildItem -Path $path -Recurse -File -Include *.exe -ErrorAction SilentlyContinue |
Where-Object { $_.CreationTime -gt $cutoff } | ForEach-Object {
$sig = Get-AuthenticodeSignature -FilePath $_.FullName
if ($sig.Status -ne 'Valid') {
$report += [PSCustomObject]@{Type='UNSIGNED_RECENT_EXE'; Path=$_.FullName; SHA256=''; Detail="Created $($_.CreationTime)"}
}
}
}
Write-Host "[*] Phase 3: Run-key persistence check (loader chains)..." -ForegroundColor Cyan
$runKeys = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run')
foreach ($rk in $runKeys) {
(Get-ItemProperty $rk).PSObject.Properties | Where-Object {
$_.Value -match 'Temp|AppData|Public' -and $_.Name -notmatch 'PSPath|PSParent|PSChild|PSDrive|PSProvider'
} | ForEach-Object {
$report += [PSCustomObject]@{Type='SUSPICIOUS_RUNKEY'; Path="$rk\$($_.Name)"; SHA256=''; Detail=$_.Value}
}
}
Write-Host "[*] Phase 4: Outbound connections from user-writable paths..." -ForegroundColor Cyan
Get-NetTCPConnection -State Established | Where-Object { $_.RemotePort -in 80,443,8080 } | ForEach-Object {
$proc = Get-Process -Id $_.OwningProcess
if ($proc.Path -match 'Temp|AppData\\Roaming|Users\\Public') {
$report += [PSCustomObject]@{Type='SUSPICIOUS_C2_CONN'; Path=$proc.Path; SHA256=''; Detail="-> $($_.RemoteAddress):$($_.RemotePort)"}
Write-Host "[!] Suspicious outbound: $($proc.Path) -> $($_.RemoteAddress):$($_.RemotePort)" -ForegroundColor Red
}
}
Write-Host "`n[*] Hunt complete. Findings: $($report.Count)" -ForegroundColor Green
$report | Format-Table -AutoSize
$report | Export-Csv -Path ".\vidar_hunt_$(Get-Date -Format 'yyyyMMdd_HHmm').csv" -NoTypeInformation
Response Priorities
Immediate (0-4 hours):
- Push all 8 published hashes to EDR blocklists, email gateways, and web proxies; enable retro-hunt across 90 days of telemetry
- Hunt for non-browser processes accessing browser credential stores (Sigma Rule 1 / KQL Stage 2) — this behavior persists regardless of obfuscation generation
- Isolate any endpoint with a confirmed hash match; capture memory before remediation (VM-decrypted strings live in runtime memory and are valuable for C2 extraction)
24 hours:
- Vidar is credential-stealing malware: force password resets for any user on an affected endpoint, revoke active sessions and OAuth tokens, and invalidate browser-synced credentials
- Reset credentials for any service logged into from the affected host (VPN, SaaS, email, crypto wallets); assume session tokens are compromised even with MFA
- Review identity provider logs (Entra ID/Okta) for anomalous logins using session-token replay from affected users in the 72 hours prior to detection
1 week:
- Deploy application control (WDAC/AppLocker) to block unsigned execution from Temp, AppData, and Public directories — this kills the smash-and-grab execution model
- Enable browser credential-store protection: enforce OS-bound encryption (Chrome App-Bound Encryption, Edge equivalent) and restrict process access to credential databases
- Migrate high-risk users to passwordless/phishing-resistant MFA (FIDO2) — infostealers harvest passwords, not hardware keys
- Establish a sandboxing pipeline with runtime string extraction capability (VM emulation) so future Vidar variants yield C2 indicators despite VM obfuscation
Related Resources
Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.