VidarMalware

“In 2023, Secureworks, now part of Sophos, reported how cybercriminals deployed the Vidar infostealer to gain access partner hotels’ Booking.com credentials.”

“Three new malware loaders have been spotted in the wild: 2CLoader, which delivers Vidar, Remus Stealer, and XWorm RAT, AvisLoader, which is delivered via ClickFix lures and communicates via Fox, an encrypted peer-to-peer (P2P) messaging network, to fetch commands and additional p…”

“Families like Lumma, RedLine, Vidar and Raccoon infect millions of machines a year, mostly personal devices, and harvest every saved password, every active browser session and every autofill record.”

“More than 3,000 actively compromised websites have been identified as hosting fake pages, per CTM360, with the attack chains leading to Vidar Stealer.”

“2CLoader: A New Malware Loader Delivering Vidar and Remus”

“Vidar adds VM-based obfuscation: The good ol' Vidar infostealer has added support for a VM-based obfuscation system.”

“In crack-disguised distribution, Remus, Vidar, LummaC2, and ACRStealer were distributed.”

“Vidar Adds Virtual Machine and Custom Stream Ciphers For String Obfuscation”

“Procurement: Buys pre-stolen logins and device footprints from stealer log markets (RedLine, Lumma, Vidar, Raccoon).”

“By checking the browser User-Agent, the TDS redirects Windows visitors to chains distributing LummaC2, Stealc, or Vidar, while sending macOS visitors to MacSync          ClickFix infection funnels.”

“El comunicado también menciona algunos de los malwares identificados en la campaña, como Vidar, Lumma (LummaC2), StealC, RedLine y Acreed, que atacan sistemas Windows, además de Atomic Stealer (AMOS), encontrado en un pequeño número de equipos M…”

“In total, it claimed that hackers harvested 1.7 billion credentials via infostealer malware between January and June 2026, with Vidar, StealC and Lumma the top three most prolific infostealer variants.”

“In July, the Remus, LummaC2, ACRStealer, and Vidar infostealers were distributed by disguising them as cracks and illegal software.”

“Infostealer credential pipeline: The most pervasive but least targeted threat comes from mass infostealer campaigns, dominated by the Vidar and Lumma malware families.”

“…eds of public repositories.In addition to discussing the Anthropic leak, this blog post also covers a “Claude Code leak” lure delivering Vidar and Ghostsocks malware that was discovered and analyzed by the Zscaler ThreatLabz team.”

“We have observed SectopRAT, Rhadamanthys, Vidar, Lumma, and NetSupport as final payloads.”

“This kind of verification has been incorporated in many other stealers including Arkei, Vidar, and Oski.”

“Group-IB researchers found that malware bundles often contained one of two highly popular stealers, RedLine Stealer and Vidar.”

“… discovered that in early 2020, before distributing the Raccoon stealer, the attackers had distributed samples of another stealer called Vidar.”

“The malware samples distributed during this campaign were samples of the Vidar password stealer, designed to intercept passwords from user browsers and various applications.”