Vidar Infostealer Strikes Back — Inside the Updated Malware-as-a-Service Threat

 

The infamous Vidar infostealer is back — and it’s stealthier than ever. First spotted in 2018, Vidar has evolved into a powerful malware-as-a-service platform capable of stealing credentials, cookies, financial data, authentication tokens, and more from compromised systems. Aryaka’s latest research on Vidar’s newest campaign explains: • Encrypted command-and-control (C2) channels • Abuse of built-in Windows tools and PowerShell • Covert exfiltration and bypass of Windows Defender and AMSI • Randomized directories, filenames, and hidden scheduled tasks • Hooks into browser APIs to snatch passwords before encryption They also cover actionable defenses to protect yourself and your organization: user education, PowerShell hardening, anomaly detection, layered DNS filtering, secure email/web gateways, and EDR tools. Vidar isn’t going away — but with the right visibility, layered defenses, and Plixer One you can stay one step ahead. https://www.darkreading.com/endpoint-security/vidar-infostealer-back-with-vengeance https://siliconangle.com/2025/09/04/vidar-infostealer-gains-traction-among-cybercriminals-ease-use-drives-adoption/