Vidar Stealer 2.0 (Loadbaks) Distributed via Fake Game Cheats on GitHub and Reddit
Vidar Stealer 2.0 (Loadbaks) Distributed via Fake Game (TL-2026-0747), also tracked as Vidar 2.0, is a high-severity malware campaign, first published 2026-06-10. It is attributed to Vidar 2.0 MaaS operators with low confidence, affects Google Chrome (and Chromium browsers), maps to 32 MITRE ATT&CK techniques (T1005, T1027, T1027.002), and is covered by 9 detection rules and 30 indicators of compromise.
Key facts for TL-2026-0747
- Threat ID
- TL-2026-0747
- Also known as
- Vidar 2.0, Vidar Stealer v2.0, Vidar 2026
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-06-10
- Last reviewed
- 2026-06-10
- Attribution
- Vidar 2.0 MaaS operators
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- consumer, gaming, technology, financial, cryptocurrency
- Target regions
- Global, North America, Europe
- Detection rules
- 9
- Indicators of compromise
- 30
Malware and tooling in Vidar Stealer 2.0 (Loadbaks) Distributed via Fake Game
Malware and tooling: Vidar, Telegram/Steam dead-drop resolver + Pastebin/GitHub-hosted next-stage address
Vidar Stealer 2.0, a fully C-rewritten infostealer announced by the actor 'Loadbaks' in October 2025, is being distributed through hundreds of fake 'free game cheat' / HWID-spoofer GitHub repositories and Reddit/Discord lures. It steals browser credentials, cookies, autofill, Azure tokens, crypto wallets, FTP/SSH credentials and Telegram/Discord/local files, and uses Telegram bots and Steam profiles as dead-drop resolvers for its C2.
How Vidar Stealer 2.0 (Loadbaks) Distributed via Fake Game works
Vidar Stealer 2.0 is the latest generation of the Vidar infostealer, originally derived from the Arkei stealer source code and active on Russian-language underground forums since 2018. On 6 October 2025 a developer using the handle 'Loadbaks' announced Vidar v2.0 on underground forums, advertising a complete rewrite from C++ to pure C, a multithreaded architecture for faster parallel data theft, polymorphic builds, and substantially improved anti-analysis. The malware is sold as Malware-as-a-Service with reporting placing the price between US$130 and US$750 (Trend Micro cites a consistent US$300 lifetime tier). Its adoption surged in late 2025 and early 2026 as operators migrated from Lumma Stealer and Rhadamanthys following law-enforcement disruption of those families, positioning Vidar (alongside StealC) to fill the resulting MaaS gap.
Acronis Threat Research Unit (TRU) documented an in-the-wild campaign (disclosed March 2026) distributing Vidar 2.0 through hundreds — potentially thousands — of fake GitHub repositories masquerading as game cheats or hardware-ID (HWID) ban-bypass tools for virtually every major online title (Counter-Strike 2, Fortnite, Valorant, Call of Duty). Reddit posts in gaming communities and Discord promote these lures, redirecting victims to fake websites that deliver a malicious archive (e.g. EzFrags_Private.zip). First-stage executables observed include TempSpoofer.exe, Monotone.exe, CFXBypass.exe and background.exe.
The infection chain is multi-stage: a Go-compiled dropper writes a VBScript (e.g. ewccbqtllunx.vbs) to %TEMP%, which launches an encoded, hidden PowerShell command that establishes TLS 1.2, downloads a staged JPEG (160066.jpg) from an HTTP staging server, and extracts a Base64 payload delimited by custom <<BASE64_START>>/<<BASE64_END>> markers. Reflective .NET assembly loading (testpowershell.dll, protected by SmartAssembly) executes the payload in memory, resolves reversed/obfuscated next-stage URLs, and establishes Startup-folder persistence. The final Vidar payload is a Themida-packed C/C++ binary that resolves Win32 APIs via byte-by-byte XOR decryption, performs IsDebuggerPresent / timing / VM checks, optionally injects via RunPE / process hollowing, and exfiltrates over HTTPS to a Cloudflare-fronted domain. Vidar 2.0 notably bypasses Chrome's AppBound cookie encryption through direct memory injection. C2 resolution is hidden behind trusted services — Pastebin/GitHub-hosted next-stage addresses and Telegram bots and Steam community profiles acting as dead-drop resolvers — making network detection harder.
MITRE ATT&CK techniques used in TL-2026-0747
Collection
T1005 Data from Local System; T1113 Screen Capture; T1115 Clipboard Data
Defense Evasion
T1027 Obfuscated Files or Information; T1027.002 Software Packing; T1036.005 Match Legitimate Resource Name or Location; T1055.012 Process Hollowing; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information; T1218.009 Regsvcs/Regasm; T1497 Virtualization/Sandbox Evasion; T1620 Reflective Code Loading; T1622 Debugger Evasion
Exfiltration
T1041 Exfiltration Over C2 Channel
Persistence
T1053.005 Scheduled Task; T1547.001 Registry Run Keys / Startup Folder
Execution
T1059.001 PowerShell; T1059.003 Windows Command Shell; T1059.005 Visual Basic; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1102.001 Dead Drop Resolver; T1105 Ingress Tool Transfer; T1573 Encrypted Channel
Discovery
T1082 System Information Discovery; T1518.001 Security Software Discovery
Privilege Escalation
T1134.003 Make and Impersonate Token
Initial Access
Credential Access
T1539 Steal Web Session Cookie; T1552.001 Credentials In Files; T1555.003 Credentials from Web Browsers
defense-impairment
Affected products and versions in Vidar Stealer 2.0 (Loadbaks) Distributed via Fake Game
- Google — Chrome (and Chromium browsers)
Vulnerable versions: credential/cookie stores incl. AppBound-encrypted cookies - Microsoft — Edge / Windows credential and Azure token stores
Vulnerable versions: all - Various — Cryptocurrency wallets, FileZilla (FTP), SSH clients, Discord, Telegram, Steam
Vulnerable versions: all
Remediation for Vidar Stealer 2.0 (Loadbaks) Distributed via Fake Game
Immediate actions
- Block the identified C2 / staging indicators (62.60.226.200, pre.sequareeus.online) at the perimeter and DNS
- Hunt for and quarantine first-stage filenames (TempSpoofer.exe, Monotone.exe, CFXBypass.exe, background.exe, Typically.com, Perfume.mdb) and the EzFrags_Private.zip lure
- Alert on the scheduled task 'SystemBackgroundUpdate' and on Windows Defender exclusion additions for user-writable folders
- Force-rotate credentials, browser session cookies, Azure tokens, FTP/SSH keys and crypto-wallet seeds for any host showing infection markers
Workarounds
- Block downloads of SFX archives and AutoIt-compiled binaries from gaming/cheat domains
- Enable Chrome AppBound encryption and device-bound session credentials where supported
Longer-term hardening
- Deploy EDR with behavioral detection for VBScript->PowerShell->reflective .NET chains and RunPE/process hollowing
- Restrict execution of WScript/PowerShell EncodedCommand for non-admin users via WDAC/AppLocker
- Enforce phishing-resistant MFA and hardware-backed token binding so stolen cookies/tokens cannot be replayed
- User awareness on the risk of 'game cheat' and HWID-spoofer downloads from GitHub/Reddit/Discord
Timeline of Vidar Stealer 2.0 (Loadbaks) Distributed via Fake Game
- Vidar first emerges as an information stealer on Russian-language underground forums, derived from the Arkei stealer source code; sold at a ~US$300 lifetime price.
- Vidar establishes its long-running pattern of using social-media 'dead-drop resolvers' (Telegram channels, Mastodon and gaming-platform profiles) to host C2 configuration, a technique it carries into the 2.0 era.
- Lumma Stealer infrastructure disrupted by law-enforcement/industry action, prompting operators to seek alternative MaaS infostealers.
- Developer 'Loadbaks' announces Vidar Stealer v2.0 on underground forums: full rewrite from C++ to pure C, multithreaded architecture, enhanced anti-analysis.
- Analysts document Vidar 2.0's pure-C multithreaded collector harvesting browser credentials, cookies, autofill, Azure/cloud tokens, cryptocurrency wallets, FTP/SSH credentials and Telegram/Discord sessions in parallel for faster exfiltration.
- Trend Micro publishes technical analysis of Vidar 2.0, documenting Chrome AppBound encryption bypass via direct memory injection and broadened data targeting.
- Rhadamanthys infostealer operations disrupted; Vidar 2.0 and StealC adoption surges as displaced operators migrate.
- Acronis TRU discloses in-the-wild campaign distributing Vidar 2.0 via hundreds of fake game-cheat / HWID-spoofer GitHub repositories and Reddit/Discord lures.
- Independent media (Hackread and others) corroborate the Acronis TRU disclosure, reporting hundreds of fake game-cheat / HWID-spoofer GitHub repositories pushing Vidar 2.0 with Reddit and Discord lures.
- Point Wild publishes deep analysis of the multi-stage chain: Go dropper -> VBScript -> PowerShell -> JPEG/TXT staged Base64 payload -> reflective .NET (testpowershell.dll) -> Themida-packed Vidar.
Sources cited for Vidar Stealer 2.0 (Loadbaks) Distributed via Fake Game
- Vidar Stealer 2.0 distributed via fake game cheats on GitHub and Reddit
- New Vidar 2.0 Infostealer Spreads via Fake Game Cheats on GitHub, Reddit
- Inside Vidar (2026): From Infection to Memory Execution via JPEG and TXT Payloads
- Fast, Broad, and Elusive: How Vidar Stealer 2.0 Upgrades Infostealer Capabilities
- Vidar Stealer 2.0 Exploits Fake Game Cheats on GitHub, Reddit
- Vidar Stealer 2.0 Spreads Through Fake Game Cheats Promoted on GitHub and Reddit
- Vidar Stealer 2.0: What to know about new infostealer features
- Vidar Trojan Analysis, Malware Overview by ANY.RUN
- HHS Vidar Malware Analyst Note (TLP:CLEAR)
Threats related to Vidar Stealer 2.0 (Loadbaks) Distributed via Fake Game
- CloudZ RAT with Pheno Plugin Hijacks Microsoft Phone Link to Steal SMS and OTPs (Cisco Talos, 2026-05)
- VEIL#DROP Campaign Uses Blogger-Hosted Stager to Deliver PureLogs Stealer
- Remcos RAT: Technical Analysis of Windows Remote Access Trojan Operations
- VIP Crypt and ASMCrypt: Commercial Crypter Services Enabling Malware Evasion of Windows Defenses
- Operation Turb00: Multi-Stage HijackLoader (IDAT Loader) Campaign Delivers Vidar v2.1 Infostealer and SnappyClient RAT via PNG-IDAT Steganography
- ScreenConnect Masked as Freeware: Large-Scale AsyncRAT Distribution Campaign via SEO-Poisoned Fake Software Sites
Detection coverage for TL-2026-0747
As of 2026-06-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0747 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-0747
4 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.