Excerpt
Vidar is a name most infostealer trackers know well -- an Arkei descendant that has been snatching browser credentials and crypto wallets since 2018. It usually ships as a .NET binary or a C++ PE. The v1.5 sample we pulled from Triage on May 13, 2026 is neither. It is a 7 MB Go 1.25.4 native PE with a twelve-category sandbox scoring system, dead-drop C2 via Telegram and Steam profile pages, and enough crypto primitives to make a librarian blush.
Previous coverage of Go-based Vidar builds (Datadog's MUT-4831, Malwarebytes March 2026) established the Telegram/Steam C2 discovery pattern. Our samp…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by derp.ca on derp.ca.
Mentioned in the excerpt
On the same topics
- StealC Is Back, and This Time It's a RATVaronis · Published 22 Oct
- Threat Group Cards: A Threat Actor EncyclopediaETDA Threat Group Cards · Added 25 Oct
- GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub RepositoriesThe Hacker News · Published 19 Oct
- GhostAction Copycats PolinRider by Hiding a Stealer in a Fake Font Fileopensourcemalware.com · Published 16 Oct
