Vidar Malware Rewrites Its Obfuscation With Every Build to Make Detection Harder

Vidar has spent years stealing the data people keep closest: saved passwords, browser cookies, wallet files and system details. Now its operators have changed a less visible part of the malware, making the code harder for defenders to recognise before it runs.

First seen in 2018, Vidar is an information stealer that has remained active through repeated rewrites. Recent campaigns have lured victims with fake software, including fraudulent installers and downloads promoted through video platforms, while other operations have used malicious repositories and game-cheat offers.

The stakes are high because stolen browser data can give criminals access to email, corporate applications, financial services and cryptocurrency accounts.

Zscaler said in a report shared with Cyber Security News (CSN) that even a single infected work device can expose reusable passwords and active sessions, creating a route into wider business systems. Zscaler researchers identified the change after tracking Vidar from May through early September 2026.

The company found that its string-hiding methods moved from basic XOR encryption, through altered ChaCha20 routines, to a custom virtual machine and stream cipher that vary with every build.

Vidar Malware Rewrites Its Obfuscation

The new approach targets strings, the readable pieces of code that can reveal a malware sample’s commands, configuration, error messages and intended actions.

By hiding those clues differently in each release, Vidar makes file-based signatures and automated analysis less dependable. In versions 2.x and 3.x, the malware runs a small virtual machine through a bytecode interpreter.

It processes a series of instructions that change a one-byte working value and emit decoded text only at selected points. The design is simple, but it is deliberately inconsistent.

Researchers found 14 instruction handlers in a sparse 256-entry table. They perform ordinary operations such as addition, subtraction, rotation, XOR, multiplication and substitution, but the opcodes, constants and lookup tables can change in every build. A four-byte XOR key also changes and seeds the interpreter.

This differs from a static packer that defenders can unpack once and recognise repeatedly. Vidar keeps the same job while changing the small details that a detection rule may expect, an issue also visible in reporting on stealthy Vidar stealer campaigns that bypass security controls to harvest credentials.

The virtual machine can directly reveal a string, or recover a key and nonce used to unlock a second encrypted data block. That extra stage means analysts must first reproduce the changing interpreter before they can see some of the malware’s meaningful text.

Custom Ciphers Raise the Cost of Analysis

Vidar pairs the virtual machine with a custom stream cipher. Versions 2.0 and 2.1 used a modified ChaCha-based design, while version 2.2 and later shifted to an add-rotate-XOR method. The interface stays familiar, but the internal arithmetic and constants are different across samples.

That pattern raises the time needed to examine a fresh file and can delay rules built around visible strings. It does not make the malware invisible, but it shifts attention toward behaviour, process activity, unusual network connections and suspicious access to browser data rather than a single fixed code pattern.

The change arrives as Vidar continues to appear in social-engineering campaigns. A fake Gemini installer campaign showed how a trusted-looking download can lead to browser-password theft, while fake YouTube software downloads have also been used to reach employees.

The per-build techniques are intended to hinder static and automated analysis. Its assessment underscores why teams should keep endpoint monitoring current, investigate unusual browser-data collection, and restrict unverified software downloads before users run them.

Organisations should also reset exposed credentials and revoke active sessions after a suspected infection, particularly where browser profiles may have stored business or administrative access.

The broader lesson is that detection needs to track what a program does, not only what its code looks like, as Vidar credential theft activity continues to affect Windows users.

Indicators of compromises (IoCs):-

Type	Indicator	Description
SHA-256	1628bb03db87f67661349e169d73ee14ed490bdbf22abfbda08ccc9ebe237974	Vidar v2.0
SHA-256	625a381981fc2d4c25c981d98b1d66bb2cf5da2dde2f590add0673a857d5b074	Vidar v2.5
SHA-256	2d43d592630ad1e012da63ef7279f95dd4a8e94964e12ca2f996051875574fa6	Vidar v3.1
SHA-256	979048a749d8f28d877c7068b1b336ecd1e349869dfb1d7c68118f90e4099bc4	Vidar v3.4

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC