Key takeaways
- Vidar is a long-running infostealer that forked from Arkei and has evolved into a central engine for credential theft and ransomware enablement.
- Infostealer activity surged between 2024 and 2025, with an 84% year-over-year increase in phishing-delivered stealers and over 65 million passwords stolen by Vidar.
- Vidar 2.0, released October 6, 2025 by developer “Loadbaks,” introduced a C-based, multithreaded architecture and an AppBound memory-injection bypass, and has since become the most active family on the Russian Market as Lumma and Rhadamanthys declined following law enforcement action.
- Vidar uses Dead Drop Resolvers on Mastodon, Telegram and Steam to hide its command-and-control (C2) infrastructure and employs oversized binaries, ZIP staging and self-cleanup to evade detection.
- Stolen Vidar logs are sold on underground markets for $1 to $100, enabling initial access brokers and ransomware operators; Scattered Spider is documented (CISA AA23-320A) using Vidar to supply ransomware crews including ALPHV / BlackCat and DragonForce.
- Session hijacking and the theft of MSP and cloud tokens make multitenant environments particularly vulnerable to Vidar.
- Acronis mitigates Vidar through layered defenses: URL filtering, behavioral detection, EDR / XDR telemetry, automated isolation and immutable backup restoration.
How has Vidar Stealer evolved? The timeline from 2018 to 2025
Vidar Stealer emerged in late 2018 as a fork of the Arkei trojan, marking its entrance into the infostealer scene. Initial Vidar campaigns focused on simple credential theft, but by 2023 threat actors were blending social engineering and supply-chain abuse. Early 2025 Vidar campaigns abused GitHub releases to host malicious payloads and used fake ClickFix and FileFix prompts that trick users into pasting PowerShell commands into the Run dialog, a technique catalogued by MITRE as T1204.004: Malicious Copy and Paste. Vidar malvertising campaigns place sponsored ads for popular or cracked software; victims who click are redirected to password-protected archives disguised as legitimate or cracked software installers, a delivery pattern confirmed in Unit 42's April 2026 analysis of a Vidar-and-XMRig campaign targeting small and medium-sized businesses (SMBs).
The October 2025 Vidar 2.0 release represented a technical overhaul. Developer “Loadbaks” rewrote the malware from C++ to C and implemented a resource-aware multithreaded architecture that counts CPU cores and memory and adjusts thread usage accordingly. Parallel extraction of browser profiles, cryptowallets and files reduces dwell time and narrows the detection window. To bypass Chrome's AppBound encryption, Vidar 2.0 launches the browser in debug mode, injects a DLL or shellcode and extracts encryption keys from memory. These keys are sent back to the main Vidar process via named pipes, avoiding forensic artifacts. The update underscores active development: Trend Micro's telemetry recorded a major spike in Vidar activity within days of the release, and by November 2025, independent research (Intrinsec) had confirmed Vidar as the most-used infostealer on the Russian Market marketplace, filling the gap left by law enforcement disruptions of Lumma and Rhadamanthys.
What is the Vidar 2.0 technical architecture?
How does Vidar Stealer work? The Vidar attack lifecycle
Vidar Stealer follows an eight-stage attack lifecycle from distribution through ransomware deployment.
- Distribution: Vidar campaigns deliver the malware via malvertising, abused GitHub releases, fake security prompts (ClickFix/FileFix) and spoofed installers. Sponsored ads for popular or cracked software lead victims to password-protected archives that hide the loader.
- User execution: Victims are instructed to run PowerShell commands or paste scripts into the Windows Run dialog. This technique abuses the user's administrative context to bypass automated defenses.
- Sandbox evasion and environment checks: Vidar performs anti-analysis checks to evade detection.
- Credential harvesting: Vidar Stealer extracts saved passwords, cookies and autofill data from Chrome, Edge, Firefox and other browsers, along with tokens from two-factor authentication apps and crypto wallets like MetaMask, Exodus, Electrum and Atomic.
- Dead Drop C2 resolution: Vidar queries Mastodon, Telegram or Steam profiles to decode the current C2 server.
- Data exfiltration: Harvested data is sent via HTTP POST requests with empty User-Agent and Host headers and a URI of “/”.
- Log resale: Vidar packages stolen credentials into logs and sells them on underground markets such as Russian Market or private Telegram channels for $1 to $100 per log. Corporate VPN and cloud keys command higher prices and are often purchased by initial access brokers.
- Ransomware affiliate access sale: Brokers resell high-value Vidar-sourced credentials to ransomware operators, who use them for initial access rather than exploiting a vulnerability.
How are Vidar Stealer logs sold? The log marketplace and IAB ecosystem
Vidar logs are compressed into archives containing credentials, cookies, system fingerprints and wallet files, then listed on marketplaces such as Russian Market and in private Telegram channels. Basic consumer-grade logs sell for as little as $1, while logs verified to contain corporate VPN, RDP or cloud administrator credentials can command up to $100 or more. Initial access brokers purchase, verify and repackage high-value logs, selling confirmed network access directly to ransomware affiliates rather than raw credential dumps, which shortens the path from infection to intrusion.
How do Vidar's Dead Drop Resolvers work?
Vidar uses a multistage C2 strategy that relies on legitimate platforms. Vidar first reaches out to Mastodon, Telegram or Steam profiles where the current C2 IP address is encoded in the bio or username. This Dead Drop Resolver technique (MITRE T1102.001) lets attackers rotate servers without recompiling the Vidar malware. Once the resolver returns the C2 address, Vidar sends harvested data via HTTP POST requests with empty User-Agent and Host headers and a URI of "/". Behavioral signatures include HTTPS connections to Mastodon domains such as ieji.de and koyu.space or to Steam profile pages, downloads of ZIP archives containing vcruntime140.dll, msvcp140.dll and sqlite3.dll, and oversized binaries (approximately 700MB) padded with null bytes.
How does Vidar Stealer enable ransomware? The Vidar-to-ransomware mapping
Vidar is a documented tool in the Scattered Spider toolkit. CISA advisory AA23-320A and MITRE ATT&CK (group G1015) confirm Scattered Spider uses Vidar and Raccoon Stealer to extract login credentials, cookies and browser history, then uses that access to deploy ransomware payloads from affiliate groups including ALPHV / BlackCat and, more recently, DragonForce. Session hijacking via stolen Vidar cookies allows attackers to log into cloud services without triggering MFA, while stolen MSP admin credentials create a cascading risk across multiple tenants.
Other ransomware operations are reported to follow a similar pattern of buying stolen VPN or RDP credentials from infostealer marketplaces, including logs that may originate from Vidar infections; for example, SafePay's July 2025 breach of Ingram Micro via a GlobalProtect VPN gateway used compromised credentials, though public reporting has not confirmed which infostealer family supplied them. Fog ransomware is separately documented deleting Veeam backups and volume shadow copies after gaining initial access through compromised VPN gateways. Because these credential-resale chains are opaque by design, attributing a specific ransomware intrusion to Vidar specifically (rather than to the broader infostealer log market) is often not possible from public reporting alone.
For deeper ransomware context, see the Acronis ransomware catalog.
Why are MSPs and cloud environments at elevated risk from Vidar?
Vidar's ability to hijack sessions makes cloud and managed service provider (MSP) environments particularly vulnerable. By stealing browser cookies and SaaS tokens, Vidar attackers can log into AWS, Azure or other cloud services without triggering multifactor authentication. Compromise of MSP administration consoles or remote-monitoring tools exposes multiple client networks from a single Vidar foothold, dramatically expanding the blast radius. Ransomware operators also exploit stolen Vidar backup credentials to disable or delete backups, undermining recovery efforts. For broader discussion of supply-chain and service-provider compromises, see the Acronis third-party compromise catalog.
How does Acronis protect against Vidar Stealer?
Acronis mitigates Vidar across prevention, detection, identity protection and recovery layers. The table below maps each stage of the Vidar attack lifecycle to the risk, the capability required to address it and the corresponding Acronis response.
Frequently asked questions about Vidar Stealer
How can I detect a Vidar Stealer infection on my network?
What signs indicate that a user executed a malicious Vidar payload?
What should I reset after a Vidar infostealer compromise?
How does Vidar Stealer bypass multifactor authentication?
Is Vidar 2.0 still active and evolving?
Does Vidar Stealer steal cryptocurrency wallets and two-factor authentication seeds?
How should MSPs respond if Vidar is detected in a client environment?
