Skip to content
vuxep.Let’s talk
INFOSTEALER GUIDE

What is Vidar Stealer? A guide for security teams.

Vidar is a Windows information stealer that first appeared in 2018 on Russian-language underground forums, initially built on the source code of the Arkei stealer [2]. Malwarebytes described it in January 2019 after finding it delivered through a malvertising chain and exploit kit alongside GandCrab ransomware [1]. It is sold to affiliates as malware-as-a-service, and Trend Micro noted that it has been kept competitive by steadily adding support for new browsers, crypto wallets and two-factor authentication apps [2] [4].

If an employee was infected Monitor stealer-log exposure
BACKGROUND

How Vidar Stealer operates.

On October 6, 2025, a developer using the handle Loadbaks announced Vidar 2.0, a rewrite that Trend Micro said can get around Chrome's app-bound encryption and also targets cloud credentials [2]. Its release coincided with the decline of Lumma Stealer, and Trend Micro reported that former Lumma customers were moving mainly to Vidar and StealC [3]. In 2026, Microsoft and Palo Alto Networks Unit 42 documented Vidar campaigns using fake AI tools and cracked software [4] [5].

01 / WHAT IT TAKES

What Vidar Stealer steals.

  • Saved browser credentials and autofill data from Chromium and Firefox browsers [2]
  • Browser cookies and history [2]
  • Saved credit card numbers [1]
  • Crypto wallet extensions and wallet data [2] [4]
  • Cloud credentials, including AWS and Azure [2]
  • FTP and SSH client credentials [2]
  • Gaming and messaging application data, plus screenshots [2]
02 / HOW IT ARRIVES

How it spreads.

  • Malvertising that leads to download pages for cracked software [4]
  • Fake AI tool installers promoted through malvertising, search results and GitHub [5]
  • Exploit kits reached from malicious ads on torrent and streaming sites (historically) [1]
  • Password-protected archives that hide a loader and drop Vidar alongside a cryptocurrency miner [4]
03 / TIMELINE

Notable events.

  1. Vidar first appears on Russian-language underground forums, built on Arkei code [2].

  2. Malwarebytes documents Vidar delivered via malvertising and the Fallout exploit kit alongside GandCrab ransomware [1].

  3. Vidar 2.0 is announced on October 6; Trend Micro reports former Lumma customers migrating to Vidar and StealC [2] [3].

  4. Microsoft reports a fake "AI plugin" malvertising campaign delivering Vidar that targeted over 66,000 devices in a single run on March 13 [5].

  5. Microsoft reports fake DeepSeek V4 installers on GitHub, and Unit 42 tracks a cracked-software campaign pairing Vidar with a crypto miner [4] [5].

INCIDENT RESPONSE

If an employee device was infected.

Stolen session cookies can let an attacker skip passwords and MFA, so a password reset alone is not enough.

  1. Isolate and reimage the infected device; do not rely on removing the stealer alone.
  2. Reset all passwords saved in browsers on the device from a clean machine, starting with email, SSO and privileged accounts.
  3. Revoke sessions and refresh tokens in your identity provider and SaaS apps, since stolen cookies can be replayed without a password.
  4. Rotate cloud access keys and tokens (for example AWS and Azure) and any SSH or FTP credentials used on the device, because Vidar 2.0 targets them [2].
  5. Review sign-in logs for unusual token use and session-cookie anomalies; Microsoft recommends watching Entra ID Protection signals such as anomalous tokens [5].
  6. Check whether the user installed cracked software or fake AI tools, and whether personal devices were used to access work accounts.
  7. Block unapproved software installs and require phishing-resistant MFA for privileged accounts [5].
COMMON QUESTIONS

Vidar Stealer,
answered.

How Vuxep monitors stealer logs

Is Vidar Stealer still active?

Yes. Microsoft documented Vidar campaigns in March and April 2026, and Unit 42 reported a Vidar campaign in April 2026 [4] [5].

What is Vidar 2.0?

Vidar 2.0 is a rewritten version announced on October 6, 2025. Trend Micro reported that it collects data faster, can get around Chrome's app-bound encryption, and targets cloud credentials as well as browser data [2].

Can Vidar steal passwords saved in Chrome?

Yes. Trend Micro reported that Vidar 2.0 targets credentials, cookies and autofill data in Chromium and Firefox browsers and can bypass Chrome's app-bound encryption [2].

How does Vidar usually infect computers?

Researchers most often see it delivered through malvertising and fake downloads, such as cracked software and fake AI tools hosted on GitHub [4] [5].

CHECK THE ORIGINAL SOURCES

Research behind this guide.

By the Vuxep team. Reviewed October 19, 2026. Products, plans, and threat activity change; check the original source for current details.

  1. Malwarebytes: Vidar and GandCrab: stealer and ransomware combo observed in the wild (January 4, 2019)
  2. Trend Micro: Fast, Broad, and Elusive: How Vidar Stealer 2.0 Upgrades Infostealer Capabilities (October 21, 2025)
  3. Trend Micro: Shifts in the Underground: The Impact of Water Kurita's (Lumma Stealer) Doxxing (October 16, 2025)
  4. Palo Alto Networks Unit 42: Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation (July 7, 2026)
  5. Microsoft Security Blog: AI brands as bait: How threat actors are using the AI hype in social engineering (June 8, 2026)
OTHER INFOSTEALERS

Compare infostealer families.

What is Lumma Stealer?What is RedLine Stealer?What is StealC?What is Raccoon Stealer?Stealer logs vs. breach data
YOUR DOMAINS. YOUR TEAM.

Find stolen work
credentials first.

Vuxep indexes credentials from stealer logs and alerts your team when accounts on your verified domains appear. See the workflow in a walkthrough.

Book a Vuxep walkthrough