Research reports

1,224 reports from 387 publishers45 added in the past week

12 reports

12 reports, newest added first

Added Sun 25 Oct

Vidar v1.5 in Go: same family, new language, heavy sandbox checks
Vidar is a name most infostealer trackers know well -- an Arkei descendant that has been snatching browser credentials and crypto wallets since 2018. It usually ships as a .NET binary or a C++ PE. The v1.5 sample we pulled from Triage on May 13, 2026 is…
Infostealers

derp.caPublished 16 May
StealC Is Back, and This Time It's a RAT
In June, Europol tore down StealC, a prominent infostealer, as part of Operation Endgame. International authorities seized 326 servers and 142 domains, recovered more than 25 million stolen credentials from 385,000 infected machines, and pulled the plug on…
MalwareInfostealersTakedowns and arrests

VaronisPublished 22 Oct
Threat Group Cards: A Threat Actor Encyclopedia
Home > List all groups > List all tools > List all groups using tool Retefe (Android) Tool: Retefe (Android) Names Retefe (Android) Category Malware Type Banking trojan, Backdoor, Info stealer, Credential stealer, Botnet (GovCERT.ch) Recently, some anti-virus…
MalwareInfostealersMobile

ETDA Threat Group Cards

GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories
The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects to phish open-source developers and deliver a stealer malware disguised within a fake font file. The latest…
Infostealers

The Hacker NewsPublished 19 Oct
GhostAction Copycats PolinRider by Hiding a Stealer in a Fake Font File
We’ve discovered a new element to the GhostAction campaign, which steals secrets through malicious GitHub Actions workflows. It now has a second stage that persists even if the victim has removed the malicious workflow. Existing Stage 1: Use stolen GitHub…
Infostealers

opensourcemalware.comPublished 16 Oct

Warden Stealer: The Rapid Rise of an Infostealer with an Appetite for AI Agent Data
Gen Threat Labs has been tracking Warden Stealer, an emerging and actively developed malware-as-a-service (MaaS) infostealer written in the Rust programming language that has, within just a few months, already become one of the most prevalent infostealers in…
MalwareInfostealers

Gen DigitalPublished 8 Oct

TLP_CLEAR-20260424-New_Vidar.pdf
No excerpt available.
Infostealers

IntrinsecPDF
Unmasking a Multi-Stage Loader: AutoIt Abuse Leading to Vidar Stealer Command-and-Control Communication
LevelBlue’s Security Services issues Threat Analysis reports to inform on impacting threats. The Threat Analysis reports investigate these threats and provide practical recommendations for protecting against them. In this Threat Analysis report, we…
MalwareInfostealers

LevelBluePublished 7 May
Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation
In April 2026, Unit 42 researchers identified a financially motivated campaign delivering Vidar stealer and the XMRig cryptocurrency miner to consumer and small- and medium-sized business victims worldwide. Attackers lure victims via malvertising to pages for…
MalwareInfostealers

Unit 42Published 7 Jul

$100k in Crypto Drained by the Underground Operation
Netskope Threat Labs analyzed a crypto-stealing operation that drains victims’ cryptocurrency exchange accounts. An Aotera/Tedy loader injects a Vidar-class stealer into a Windows process, which then launches Chrome or Edge and injects its scripts into the…
MalwareInfostealers

NetskopePublished 1 Oct

Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.