Vidar Malware Rewrites Its Obfuscation With Every Build to Make Detection Harder
Vidar infostealer rewrites its string obfuscation on every build using custom virtual machines and stream ciphers, blunting static detection of the credential thief.
Zscaler tracking from May through early September 2026 shows Vidar's string-hiding evolved from basic XOR encryption to modified ChaCha20 routines and then a per-build custom virtual machine and stream cipher. The VM uses a sparse 256-entry opcode table with 14 handlers whose opcodes, constants, and XOR seed change every build, undermining file-based signatures and automated analysis. Distribution continues through social engineering, including a fake Gemini installer and video-platform download lures. Four SHA-256 IoCs for versions 2.0 through 3.4 were published.
- String obfuscation changed from XOR to per-build custom VM and stream cipher
- Bytecode interpreter with 14 handlers and shifting opcodes defeats static signatures
- Spread via fake installers including fraudulent Gemini installer and video-platform downloads
- Stolen browser data exposes corporate apps, email, finance, and crypto accounts
- ATT&CK
- T1027 Obfuscated Files or InformationT1555.003 Credentials from Web BrowsersT1204.002 Malicious File
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha256 | 1628bb03db87f67661349e169d73ee14ed490bdbf22abfbda08ccc9ebe237974 | of compromises (IoCs):- Type Indicator Description SHA-256 1628bb03db87f67661349e169d73ee14ed490bdbf22abfbda08ccc9ebe237974 Vidar v2.0 SHA-256 625a381981fc2d4c25c981d98b1d66bb2cf5da2d |
| sha256 | 2d43d592630ad1e012da63ef7279f95dd4a8e94964e12ca2f996051875574fa6 | 8b1d66bb2cf5da2dde2f590add0673a857d5b074 Vidar v2.5 SHA-256 2d43d592630ad1e012da63ef7279f95dd4a8e94964e12ca2f996051875574fa6 Vidar v3.1 SHA-256 979048a749d8f28d877c7068b1b336ecd1e34986 |
| sha256 | 625a381981fc2d4c25c981d98b1d66bb2cf5da2dde2f590add0673a857d5b074 | 9d73ee14ed490bdbf22abfbda08ccc9ebe237974 Vidar v2.0 SHA-256 625a381981fc2d4c25c981d98b1d66bb2cf5da2dde2f590add0673a857d5b074 Vidar v2.5 SHA-256 2d43d592630ad1e012da63ef7279f95dd4a8e949 |
| sha256 | 979048a749d8f28d877c7068b1b336ecd1e349869dfb1d7c68118f90e4099bc4 | 7279f95dd4a8e94964e12ca2f996051875574fa6 Vidar v3.1 SHA-256 979048a749d8f28d877c7068b1b336ecd1e349869dfb1d7c68118f90e4099bc4 Vidar v3.4 Note: IP addresses and domains are intentionally |
From the original article
3 min read at cybersecuritynews.com
Vidar has spent years stealing the data people keep closest: saved passwords, browser cookies, wallet files and system details. Now its operators have changed a less visible part of the malware, making the code harder for defenders to recognise before it runs. First seen in 2018, Vidar is an information stealer that has remained active […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.