Dashboard

Vidar

A long-running Windows stealer, often dropped with other malware.

Also called
Vidar stealer
Seen since
2018
Runs on
Windows
Sold as
Malware-as-a-service, built on Arkei

What Vidar takes

  • Browser passwords, cookies, history, and autofill
  • Cryptocurrency wallets
  • Files from the desktop and documents folders
  • A screenshot and details of the computer

How it spreads

  • Loaders that drop Vidar next to other malware
  • Fake software downloads and malicious ads
  • Phishing attachments

Background

Vidar is one of the oldest stealers still in use. It has been updated many times. It grew out of the older Arkei stealer.

It often finds its control servers through profile pages on ordinary public sites. That makes a simple domain block list less useful. Logs from those campaigns still show up in Telegram dumps years later.

Checking for your logins

Search an email, username, company domain, login URL, password, or IP. The index covers logs from every family, Vidar included. A dump usually does not record which malware wrote it, so a result will not say it was Vidar.

The steps afterwards are the same either way. Clean the device, then change passwords from a machine that was not infected. What to do.

Other families

  • RedLine Stealer. For years the most common Windows stealer in circulating logs.
  • Lumma Stealer. Often delivered by fake verify-you-are-human pages.
  • Raccoon Stealer. A cheap Windows stealer. Its alleged operator was arrested in 2022.
  • StealC. A 2023 Windows stealer that copies features from older families.
  • Atomic macOS Stealer. A macOS stealer. It prompts for the user password and opens the Keychain.

Questions

Is Vidar still used?
Yes. It has been around since 2018 and still appears in new dumps, often next to other malware from the same loader.
Does Vidar only steal passwords?
No. It also takes cookies, wallet files, documents, and a screenshot of the desktop.

Search an email, username, URL, password, or IP. Open search.

More