{
  "family": "vidar",
  "sample_count": 1,
  "category": "infostealer",
  "description": "Trojan:Win32/Vidar (commercially marketed as Vidar Stealer) is a prolific, commercially available information-stealing trojan first observed on underground Russian cybercrime forums in late 2018. Architecturally forked from the Arkei stealer source code, Vidar operates under an accessible Malware-as-a-Service (MaaS) rental model costing between $250 and $500 per month. Vidar specializes in the rapid, comprehensive harvesting of sensitive user data from infected Windows hosts, including cryptocurrency wallets (Bitcoin, Ethereum, Monero, Electrum, MetaMask), stored web browser credentials and autocomplete history (Chrome, Firefox, Edge, Brave), active session cookies, FTP client credentials (FileZilla), VPN profiles, and desktop two-factor authentication tokens (Authy). Vidar pioneered novel C2 rendezvous techniques, utilizing public social media profiles (Telegram channels, Steam community bios, Twitter accounts, and Mastodon bio descriptions) as unblockable dead-drop resolvers that dynamically point worker bots to active C2 IP addresses. Once credential collection is completed and exfiltrated over HTTP POST, Vidar executes automated self-deletion commands to eliminate forensic traces.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Vidar",
    "Vidar Stealer",
    "Trojan.Vidar",
    "Spyware.VidarStealer",
    "PWS.Win32.Vidar"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Vidar Stealer?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Vidar is a commercial infostealer malware sold on underground forums that extracts browser credentials, cryptocurrency wallets, and 2FA tokens."
      }
    },
    {
      "@type": "Question",
      "name": "How does Vidar locate its Command and Control servers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Vidar uses social media profiles (Telegram channels, Steam user bios, Mastodon) as dead-drop resolvers to dynamically obtain active C2 IP addresses."
      }
    },
    {
      "@type": "Question",
      "name": "What data is targeted by Vidar?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Vidar harvests browser passwords, autofill data, credit cards, cryptocurrency private keys, Telegram session files, and VPN client configurations."
      }
    },
    {
      "@type": "Question",
      "name": "How is Vidar typically distributed?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Vidar is distributed via search engine malvertising promoting cracked software, weaponized Office attachments, and loader partnerships."
      }
    },
    {
      "@type": "Question",
      "name": "What vulnerabilities are leveraged in Vidar campaigns?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Phishing droppers staging Vidar frequently exploit Microsoft Office vulnerabilities including CVE-2017-11882 and CVE-2022-30190 (Follina)."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1555.003",
    "T1114.001",
    "T1102.001",
    "T1071.001",
    "T1070.004",
    "T1566.001"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1555.003",
      "name": "Credentials from Web Browsers",
      "tactic": "credential-access"
    },
    {
      "id": "T1114.001",
      "name": "Email Collection",
      "tactic": "collection"
    },
    {
      "id": "T1102.001",
      "name": "Dead Drop Resolver",
      "tactic": "command-and-control"
    },
    {
      "id": "T1071.001",
      "name": "Web Protocols",
      "tactic": "command-and-control"
    },
    {
      "id": "T1070.004",
      "name": "File Deletion",
      "tactic": "defense-evasion"
    },
    {
      "id": "T1566.001",
      "name": "Spearphishing Attachment",
      "tactic": "initial-access"
    }
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "first_seen": 2018,
  "lineage": {
    "derived_from": [
      "arkei"
    ],
    "variants": [
      "vidar v1.0",
      "vidar telegram dead-drop edition",
      "vidar modular stealer (2022-2024)"
    ]
  },
  "attribution": [
    {
      "actor": "Russian Cybercrime Underground",
      "confidence": "high"
    },
    {
      "actor": "Vidar MaaS Operators",
      "confidence": "high"
    }
  ],
  "exploited_cves": [
    "CVE-2017-11882",
    "CVE-2022-30190"
  ],
  "c2_profile": {
    "protocols": [
      "HTTPS",
      "HTTP"
    ],
    "ports": [
      443,
      80
    ],
    "traffic_identifiability": "medium"
  },
  "iocs": {
    "file_hashes": [
      "4b6c33fef79ebbcce763ffca07fa81215b493c4e3658ebc76b9ee2f8719cb49d",
      "89a27eb2762eb295fe3509bc9f636257a3e7ef7b1bcfd1a7b489d81d6f228b7e"
    ],
    "delivery": [
      "cracked_software_torrents",
      "malvertising",
      "phishing_attachments"
    ],
    "persistence": [
      "None (Self-Deleting Execution)"
    ]
  },
  "sources": [
    {
      "name": "Recorded Future Insikt Group: Technical Analysis of Vidar Stealer",
      "url": "https://www.recordedfuture.com/"
    },
    {
      "name": "Mandiant Threat Research: Infostealer Ecosystem Overview",
      "url": "https://www.mandiant.com/"
    },
    {
      "name": "NIST National Vulnerability Database CVE-2022-30190",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30190"
    }
  ],
  "containment_steps": [
    "Force immediate global password and session token revocation for all accounts accessed on affected hosts.",
    "Transfer cryptocurrency funds to newly generated hardware-backed offline wallets immediately.",
    "Block outbound HTTP communication to identified Vidar dead-drop endpoints and C2 servers.",
    "Apply security patches for Microsoft Office vulnerabilities CVE-2017-11882 and CVE-2022-30190."
  ],
  "what_to_avoid": [
    "Never store master passwords, seeds, or unencrypted private keys in plaintext desktop files or browser autofill.",
    "Avoid downloading cracked software, keygens, or games from untrusted file repositories.",
    "Do not allow unmanaged employee workstations to access corporate email without hardware MFA."
  ],
  "target_industries": [
    "consumers",
    "cryptocurrency",
    "financial_services",
    "technology"
  ],
  "motivation": "Credential Theft, Cryptocurrency Plunder & Cybercrime Brokering",
  "threat_actors": [
    "Vidar MaaS Operators"
  ],
  "target_geographies": [
    "US",
    "DE",
    "GB",
    "FR",
    "IN",
    "BR",
    "CA"
  ],
  "attack_stage": [
    "initial-access",
    "execution",
    "credential-access",
    "collection",
    "exfiltration"
  ],
  "ecosystem": [
    "windows",
    "x86",
    "x64"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}