Vidar Stealer 2.0 data-theft and evasion upgrade
Malware Activity
Summary
Hide ▲
Show ▼
The release of Vidar Stealer 2.0 is likely to increase infections because the malware now steals data faster and evades detection more effectively. The new build is a major rewrite in C and adds multi-threaded data stealing plus stronger anti-analysis checks. It also bypasses Chrome App-Bound encryption by injecting into running browser processes and stealing keys from memory. The expanded targeting of browser, cloud, and messaging credentials raises the risk of account compromise and downstream theft through Q4 2025.
Related Happenings
REMUS infostealer browser-session and password-manager collection expansion
Malware Activity
H score21
First: 15.05.2026 17:02
Last: 15.05.2026 17:02
Sources 1
About this happening:
REMUS expanded its session-theft and password-manager collection capabilities, increasing the malware’s ability to capture authenticated access and browser-side data....
REMUS infostealer browser-session and password-manager collection expansion
Malware ActivityAbout this happening: REMUS expanded its session-theft and password-manager collection capabilities, increasing the malware’s ability to capture authenticated access and browser-side data....
Vidar Stealer ClickFix campaign targeting multiple sectors
Campaign
H score38
First: 08.05.2026 14:00
Last: 08.05.2026 14:00
Sources 1
About this happening:
The Vidar Stealer campaign is using ClickFix social engineering and compromised WordPress sites to deliver password-stealing malware, widening risk for infrastructur...
Vidar Stealer ClickFix campaign targeting multiple sectors
CampaignAbout this happening: The Vidar Stealer campaign is using ClickFix social engineering and compromised WordPress sites to deliver password-stealing malware, widening risk for infrastructur...
Vidar infostealer market rise and distribution expansion
Malware Activity
H score30
First: 28.04.2026 22:07
Last: 28.04.2026 22:07
Sources 1
About this happening:
Vidar remains a long-running infostealer threat, and Aryaka reported a fresh campaign in recent weeks that adds new obfuscation techniques and stronger steal...
Vidar infostealer market rise and distribution expansion
Malware ActivityAbout this happening: Vidar remains a long-running infostealer threat, and Aryaka reported a fresh campaign in recent weeks that adds new obfuscation techniques and stronger steal...
Storm infostealer server-side decryption activity
Malware Activity
H score18
First: 02.04.2026 17:15
Last: 02.04.2026 17:15
Sources 1
About this happening:
The Storm infostealer now steals browser credentials, session cookies, and crypto wallets and forwards them to attacker infrastructure for server-side decryption...
Storm infostealer server-side decryption activity
Malware ActivityAbout this happening: The Storm infostealer now steals browser credentials, session cookies, and crypto wallets and forwards them to attacker infrastructure for server-side decryption...
Venom Stealer MaaS continuous credential theft and exfiltration
Malware Activity
H score29
First: 01.04.2026 16:30
Last: 01.04.2026 16:30
Sources 1
About this happening:
The Venom Stealer malware-as-a-service platform has been identified as a credential-theft threat that keeps exfiltrating data after infection, extending the window for...
Venom Stealer MaaS continuous credential theft and exfiltration
Malware ActivityAbout this happening: The Venom Stealer malware-as-a-service platform has been identified as a credential-theft threat that keeps exfiltrating data after infection, extending the window for...
Timeline
-
22.10.2025 01:26 2 articles · 8mo ago
Vidar Stealer 2.0 adds faster theft and stronger evasion
Technical Analysis UpdateSecurity researchers warned that Vidar Stealer 2.0 is likely to increase infections after the malware developer released a major rewrite in C with multi-threading data stealing, stronger anti-analysis checks, control-flow flattening, and Chrome's App-Bound encryption bypasses. Trend Micro described a browser-memory technique that launches browsers with debugging enabled, injects code into running browser processes with shellcode or reflective DLL injection, extracts encryption keys from browser memory, and returns them to the main malware process via named pipes. The malware targets browser cookies and autofill, cryptocurrency wallet extensions and desktop apps, cloud credentials, Steam accounts, Telegram, and Discord data, and researchers expect it to become more prevalent through Q4 2025.
Show sources
- Vidar Stealer 2.0 adds multi-threaded data theft, better evasion — www.bleepingcomputer.com — 22.10.2025 01:26
- Vidar Stealer 2.0 adds multi-threaded data theft, better evasion — www.bleepingcomputer.com — 22.10.2025 01:26