Vidar Malware: How the Multithreaded Windows Stealer Works

Key Takeaways

• Vidar is a Windows information stealer sold as malware-as-a-service.
• Vidar’s new version rewrites the malware in pure C with a multithreaded engine that scales to victim hardware.
• Vidar bypasses Chrome App-Bound Encryption by scanning forked browser memory and injecting an APC to decrypt the master key.
• Stolen data exfiltrates over HTTP multipart POST to round-robin C2 using Telegram and Steam profiles as dead drops.
• The Picus Platform lets teams simulate Vidar infostealer attacks and validate security controls against this threat.

Vidar is a Windows information stealer that was first observed in 2018 on Russian-language underground forums, where it emerged as a fork of the Arkei stealer source code.

It is sold as a malware-as-a-service (MaaS) product, and its core function is to harvest browser credentials, cookies, cryptocurrency wallets, cloud tokens, and files from an infected host and exfiltrate them to attacker infrastructure.

In this blog, we explain how Vidar operates at each stage of its execution flow, from delivery and defense evasion through memory-scanning credential theft and exfiltration, and show how Picus validates your security controls against this threat.

Vidar at a Glance

What Is Vidar Malware?

Vidar is a modular Windows infostealer built for high-speed, broad-scope data collection.

Since 2018, it has distinguished itself from competitors like Raccoon and RedLine by continuously adding support for new browsers, wallets, and two-factor authentication applications, backed by stable developer support that has kept a loyal affiliate base.

At its core, Vidar does three things:

1. Steals credentials and secrets: browser passwords, cookies, autofill, and credit cards; crypto wallet files and extensions; cloud CLI credentials; FTP/SSH sessions; and messaging/gaming tokens.
2. Grabs files and screenshots: a file-grabber sweeps user directories and removable drives, and it captures desktop screenshots.
3. Exfiltrates over resilient channels: it sends the loot via HTTP multipart POST to a round-robin C2 that abuses Telegram and Steam profiles as dead drops.

The Vidar 2.0 rewrite added four capabilities that define the modern strain: a complete C rewrite, a multithreaded data-theft architecture, an App-Bound Encryption (ABE) bypass, and an automatic "morpher" paired with control-flow flattening [1].

How Does Vidar Malware Work?

Vidar works by dropping onto a host through a signed loader, running anti-analysis checks, profiling the system, stealing browser credentials (including an App-Bound Encryption bypass), harvesting wallets, tokens, and files in parallel, and exfiltrating everything to a round-robin command-and-control (C2) server.

We explain each of these capabilities in detail below.

Initial Infection and Loader Delivery

Vidar is distributed through loaders rather than directly.

In one large 2026 campaign, an affiliate used malvertising to push pages impersonating cracked versions of copyright-protected software, delivering the loader inside a password-protected archive with a .bin extension [3]. The loaders are produced by the Factory-v3 (internal name UpdateFactory) Go-based MaaS builder.

The password protection and .bin naming are a deliberate choice to bypass scanning and prevent automated sandbox detonation, which cannot open the archive without the password.

Code-Signing Abuse

Loader samples carry a fabricated Authenticode signature to create a false sense of legitimacy before any malicious activity runs. The certificate impersonates a legitimate publisher but chains to a self-signed root that is not present in any public trust store [3]:

Because the certificate does not chain to a Microsoft-trusted root, Windows SmartScreen and Authenticode validation flag the binary as untrusted. In fact, the technique relies on the victim recognizing the brand name in the signature dialog and proceeding anyway.

File-Size Inflation

EXE loaders for Vidar Malware append hundreds of megabytes of null bytes after the last PE section, pushing total file size as high as 491 MB [3].

Most automated sandboxes enforce an upper file-size limit of 50 to 100 MB and silently skip oversized submissions, so the malware never detonates in analysis.

Anti-Analysis and Evasion

Once running, Vidar 2.0 performs extensive anti-analysis checks before any theft occurs: debugger detection, timing verification, system-uptime validation, and hardware profiling to ensure it runs on a genuine victim rather than a sandbox [1]. All checks must pass; any failure results in immediate termination to evade sandbox detonation.

AMSI Bypass

AMSI is the Windows interface that lets antivirus products inspect scripts and in-memory code right before they run, and AmsiScanBuffer is the function that hands a buffer to the scanner for a verdict.

The Vidar core payload neutralizes it with an in-memory bypass before any stealer logic runs: it loads amsi.dll, resolves AmsiScanBuffer, and overwrites its first six bytes with a stub that immediately returns the error code E_INVALIDARG. Because the function now returns before scanning anything, every later script and code execution slips past AMSI unchecked [3]:

Control-Flow Flattening

Vidar 2.0 makes heavy use of control-flow flattening [1], transforming natural program flow into a numeric state machine driven by nested switch/while structures, which obscures the original logic and makes analysis of the sample harder.

At a conceptual level, control-flow flattening can be explained like this:

Data Theft

With evasion complete, Vidar turns to its main job, stealing data, using a multithreaded engine to sweep browsers, wallets, cloud tokens, and files in parallel.

Multithreaded Engine

A defining feature of Vidar 2.0 is a multithreading system that scales to the victim's hardware. It queries CPU core count via GetSystemInfo and available physical memory via GlobalMemoryStatusEx, then calculates a worker-thread count that grows on powerful systems and shrinks on weaker machines [1].

This lets Vidar steal from browsers, wallets, and files simultaneously rather than serially, cutting dwell time and shrinking the detection window:

The logic can be summarized as follows:

Broad-Scope Data Theft

Vidar's parallel workers sweep a wide range of secret stores across five main categories: browser credentials, cryptocurrency wallets, cloud credentials, FTP/SSH sessions, and gaming/social platforms.

Most important paths it targets are given below [1]:

A file-grabber component then walks user directories and removable drives for valuable files, focusing on cryptocurrency keys and potential credential files. Also, it captures desktop screenshots for additional intelligence value.

Browser Credential Extraction

Vidar targets both traditional browser storage and Chrome's App-Bound Encryption using a tiered approach. It enumerates browser profiles across Chrome, Edge, Opera, Opera GX, Vivaldi, Firefox, Waterfox, and Palemoon.

For legacy protection, Vidar reads each browser's Local State file, locates the encrypted_key field, and attempts standard Data Protection API (DPAPI) decryption with CryptUnprotectData [1]:

For Chrome App-Bound Encryption (ABE) protection, the DPAPI path alone no longer yields cookies and passwords. This time, the end goal for the stealer is the browser's master key, which alone decrypts any ABE-protected data [2].

On disk, that key is protected with CryptProtectData; in memory it is protected with CryptProtectMemory using the CRYPTPROTECTMEMORY_SAME_PROCESS flag, meaning it can only be decrypted from inside the browser process. Vidar takes the memory route and solves two problems: finding the master key, and getting it decrypted (ABE bypass).

The whole bypass comes down to four steps:

1. Copy the browser's memory: Vidar clones the running browser with NtCreateProcessEx (a "fork"). A fork is a frozen, read-only duplicate of the browser's memory, so Vidar can search it without touching or crashing the real browser.
2. Find the key: It scans that copy for a fixed 32-byte fingerprint that marks where Chrome keeps its master key. The first bytes of the fingerprint are simply the text v20:

1. Ask the browser to decrypt it: The key can only be unlocked from inside the browser itself, so Vidar cannot decrypt it on its own. Instead it plants a small task (an APC, or Asynchronous Procedure Call) inside a browser thread that runs the normal Windows unlock function CryptUnprotectMemory for it:

1. Read the result and clean up: Vidar takes a fresh copy of the browser's memory, reads the now-decrypted key, and (to avoid leaving the browser in a broken state) re-locks the original key. If nothing decrypted, it restarts the browser and tries again.

The net effect: Vidar walks away with the master key that unlocks every saved password and cookie, while the real browser keeps running as if nothing happened.

Data Exfiltration

Vidar stages stolen data and exfiltrates over HTTP multipart form submissions to a round-robin C2 infrastructure.

Rather than hardcoding a single C2 domain, it uses dead-drop resolvers, embedding Telegram profile URLs and Steam community profile URLs whose page content points to the live C2.

During initialization, the malware builds its configuration array with the dead-drop URLs [1]:

How Picus Simulates Vidar Malware Attacks?

We strongly suggest simulating Vidar Malware Attacks to test the effectiveness of your security controls against real-life cyber attacks using the Picus Platform. You can also test your defenses against hundreds of other malware variants, such as BRICKSTORM, VenomRAT, Chinotto, and Rustonotto, within minutes with a 14-day free trial of the Picus Platform.

Picus Threat Library includes the following threats for the Vidar Malware Attacks:

Start simulating emerging threats today and get actionable mitigation insights with a 14-day free trial of the Picus Platform.

References

[1] “Fast Broad and Elusive How Vidar Stealer 2 Upgrades Infostealer Capabilities,” Trend Micro. Accessed: Jul. 13, 2026. [Online]. Available: https://www.trendmicro.com/tr_tr/research/25/j/soc-agentic-siem/how-vidar-stealer-2-upgrades-infostealer-capabilities.html

[2] V. Krejsa, “Inside Vidar’s ABE Bypass: From Memory Scanning to APC Injections,” Gen Digital Inc. Accessed: Jul. 13, 2026. [Online]. Available: https://www.gendigital.com/blog/insights/research/inside-vidar-abe-bypass

[3] B. Nannaka and P. K. Chhaparwal, “Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation,” Unit 42. Accessed: Jul. 13, 2026. [Online]. Available: https://unit42.paloaltonetworks.com/vidar-stealer-xmrig-miner-campaign-analysis/