Vidar Infostealer Back with a Vengeance

The Vidar infostealer has returned with a vengeance, evolving with a suite of new obfuscation techniques and covert data exfiltration methods, according to Aryaka Threat Research Lab. Researchers say the latest campaign uses encrypted command-and-control channels, Living-off-the-Land Binaries and covert exfiltration to boost stealth and persistence.

Vidar spreads via social engineering, phishing emails, compromised or malicious websites, and malvertising campaigns promising legitimate software, a multi-pronged approach designed to bypass basic defenses. Technical details describe the infection chain starting with a PowerShell script that loads the Vidar binary and other components, with the malware disguising traffic as PowerShell and employing exponential backoff with jitter to reduce detection.

It also seeks to maintain persistence by creating a hidden, logon-at-reboot scheduled task and to evade protections by adding Windows Defender exceptions and attempting to bypass AMSI, with data exfiltration traffic secured by TLS. Dark Reading notes the malware’s continued prominence given its ease of deployment, versatility and plugin compatibility, posing a significant risk to both individuals and enterprise environments.