Vidar Stealer Exploits: Direct Memory Attacks Used to Capture Browser Credentials

On 6 October 2025, the cybercriminal developer known as Loadbaks announced the release of Vidar Stealer 2.0 on underground forums, introducing a sophisticated information-stealing malware that uses direct memory injection to bypass modern browser protections. Vidar 2.0 marks a complete architectural overhaul, moving from C++ to a pure C implementation, which its developers say enhances performance and stealth.

The update follows a period of declining Lumma Stealer activity, with hackers apparently seeking more effective tools, and Vidar 2.0 introduces advanced anti-analysis measures, multithreaded data theft capabilities, and techniques to extract browser credentials that can defeat Chrome’s AppBound encryption protections.

The malware is priced at a lifetime $300, offering attackers potent credential-stealing capabilities targeting browser data, cryptocurrency wallets, and two-factor authentication apps, according to the article. Binary analysis shows a multi-stage process that begins with traditional browser-profile enumeration and DPAPI key extraction, then escalates to injecting code into running browser processes via shellcode or reflective DLL injection. Vidar first emerged in 2018 on Russian-language forums, and since then has distinguished itself with frequent updates and a comprehensive feature set.