Vidar (Organization): news timeline & CVEs

Warden Stealer Spreads Through ClickFix, Malvertising, Cracked Software and Game Cheats

Gen Digital details Warden Stealer, a Rust MaaS infostealer spread via ClickFix, malvertising, cracked software, and fake game cheats stealing browser, wallet, and AI tokens.

Warden Stealer is a malware-as-a-service Windows infostealer written in Rust, first observed in May 2026 and promoted publicly since August 2026, linked by Gen Threat Labs to the previously tracked CallbackBeaver family. It steals browser data, passwords, cookies, cryptocurrency wallets, and files, bypasses Chromium Application-Bound Encryption by recovering the v20_master_key from browser memory, and includes a crypto clipper plus loader using VirtualAllocEx/WriteProcessMemory/CreateRemoteThread injection. It also targets locally stored AI assistant and coding agent data from Claude, Codex, Grok, and Cursor, including tokens, MCP configs, and credentials.

Cyber Security NewsOct 9, 12:32 UTC · 7d agoMalware in the wild4· 3 reads

Vidar Malware Rewrites Its Obfuscation With Every Build to Make Detection Harder

Vidar infostealer rewrites its string obfuscation on every build using custom virtual machines and stream ciphers, blunting static detection of the credential thief.

Zscaler tracking from May through early September 2026 shows Vidar's string-hiding evolved from basic XOR encryption to modified ChaCha20 routines and then a per-build custom virtual machine and stream cipher. The VM uses a sparse 256-entry opcode table with 14 handlers whose opcodes, constants, and XOR seed change every build, undermining file-based signatures and automated analysis. Distribution continues through social engineering, including a fake Gemini installer and video-platform download lures. Four SHA-256 IoCs for versions 2.0 through 3.4 were published.

Cyber Security NewsSep 22, 08:40 UTC · 25d agoMalware in the wild2· 1 read

Vidar

Timeline2 articles

Appears with

Warden Stealer Spreads Through ClickFix, Malvertising, Cracked Software and Game Cheats

Vidar Malware Rewrites Its Obfuscation With Every Build to Make Detection Harder