Major Threat: Vidar Stealer v2.0 Bypasses Chrome AppBound Encryption with Multithreaded Memory Injection

Researchers at Trend Micro have released an in-depth analysis of Vidar Stealer v2.0, a major overhaul rewritten entirely in C that introduces multithreaded data theft, anti-analysis features, and a memory injection technique designed to bypass Google Chrome’s AppBound encryption. On 6 October 2025, the malware’s developer, known as “Loadbaks”, announced the release of Vidar Stealer v2.0 on underground forums, marking a full migration from C++ to C to boost performance and stability.

The new version uses a multithreading system that scales with the victim’s hardware, allowing parallel data harvesting from browsers, crypto wallets, and cloud directories, rather than a linear approach. It can bypass Chrome’s AppBound encryption by launching Chrome in debugging mode and injecting code into running processes to extract encryption keys from memory, then sending them back via named pipes.

Trend Micro notes Vidar 2.0 also features an automatic polymorphic builder and obfuscated code, plus robust evasion like debugger detection and sandbox checks, signalling a move toward a commercially minded, stealthy infostealer.