# Vidar Stealer 2.0 (Loadbaks) Distributed via Fake Game Cheats on GitHub and Reddit

> Vidar Stealer 2.0, a fully C-rewritten infostealer announced by the actor 'Loadbaks' in October 2025, is being distributed through hundreds of fake 'free game cheat' / HWID-spoofer GitHub repositories and Reddit/Discord lures. It steals browser credentials, cookies, autofill, Azure tokens, crypto wallets, FTP/SSH credentials and Telegram/Discord/local files, and uses Telegram bots and Steam profiles as dead-drop resolvers for its C2.

- **Published:** 2026-06-10T00:00:00Z
- **Last reviewed:** 2026-06-10T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0747
- **ID:** TL-2026-0747
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Vidar 2.0 MaaS operators
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Vidar Stealer 2.0 is the latest generation of the Vidar infostealer, originally derived from the Arkei stealer source code and active on Russian-language underground forums since 2018. On 6 October 2025 a developer using the handle 'Loadbaks' announced Vidar v2.0 on underground forums, advertising a complete rewrite from C++ to pure C, a multithreaded architecture for faster parallel data theft, polymorphic builds, and substantially improved anti-analysis. The malware is sold as Malware-as-a-Service with reporting placing the price between US$130 and US$750 (Trend Micro cites a consistent US$300 lifetime tier). Its adoption surged in late 2025 and early 2026 as operators migrated from Lumma Stealer and Rhadamanthys following law-enforcement disruption of those families, positioning Vidar (alongside StealC) to fill the resulting MaaS gap.

Acronis Threat Research Unit (TRU) documented an in-the-wild campaign (disclosed March 2026) distributing Vidar 2.0 through hundreds — potentially thousands — of fake GitHub repositories masquerading as game cheats or hardware-ID (HWID) ban-bypass tools for virtually every major online title (Counter-Strike 2, Fortnite, Valorant, Call of Duty). Reddit posts in gaming communities and Discord promote these lures, redirecting victims to fake websites that deliver a malicious archive (e.g. EzFrags_Private.zip). First-stage executables observed include TempSpoofer.exe, Monotone.exe, CFXBypass.exe and background.exe.

The infection chain is multi-stage: a Go-compiled dropper writes a VBScript (e.g. ewccbqtllunx.vbs) to %TEMP%, which launches an encoded, hidden PowerShell command that establishes TLS 1.2, downloads a staged JPEG (160066.jpg) from an HTTP staging server, and extracts a Base64 payload delimited by custom <<BASE64_START>>/<<BASE64_END>> markers. Reflective .NET assembly loading (testpowershell.dll, protected by SmartAssembly) executes the payload in memory, resolves reversed/obfuscated next-stage URLs, and establishes Startup-folder persistence. The final Vidar payload is a Themida-packed C/C++ binary that resolves Win32 APIs via byte-by-byte XOR decryption, performs IsDebuggerPresent / timing / VM checks, optionally injects via RunPE / process hollowing, and exfiltrates over HTTPS to a Cloudflare-fronted domain. Vidar 2.0 notably bypasses Chrome's AppBound cookie encryption through direct memory injection. C2 resolution is hidden behind trusted services — Pastebin/GitHub-hosted next-stage addresses and Telegram bots and Steam community profiles acting as dead-drop resolvers — making network detection harder.

## MITRE ATT&CK

- T1189 Drive-by Compromise
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1059.005 Visual Basic
- T1059.003 Windows Command Shell
- T1547.001 Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task
- T1134.003 Make and Impersonate Token
- T1027 Obfuscated Files or Information
- T1027.002 Software Packing
- T1140 Deobfuscate/Decode Files or Information
- T1685 Disable or Modify Tools
- T1055.012 Process Hollowing
- T1620 Reflective Code Loading
- T1497 Virtualization/Sandbox Evasion
- T1622 Debugger Evasion
- T1036.005 Match Legitimate Resource Name or Location
- T1218.009 Regsvcs/Regasm
- T1070.004 File Deletion
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1552.001 Credentials In Files
- T1518.001 Security Software Discovery
- T1082 System Information Discovery
- T1005 Data from Local System
- T1113 Screen Capture
- T1115 Clipboard Data
- T1071.001 Web Protocols
- T1102.001 Dead Drop Resolver
- T1105 Ingress Tool Transfer
- T1573 Encrypted Channel
- T1041 Exfiltration Over C2 Channel

## Sources

- [Vidar Stealer 2.0 distributed via fake game cheats on GitHub and Reddit](https://www.acronis.com/en/tru/posts/vidar-stealer-20-distributed-via-fake-game-cheats-on-github-and-reddit/)
- [New Vidar 2.0 Infostealer Spreads via Fake Game Cheats on GitHub, Reddit](https://hackread.com/vidar-2-0-infostealer-fake-game-cheats-github-reddit/)
- [Inside Vidar (2026): From Infection to Memory Execution via JPEG and TXT Payloads](https://www.pointwild.com/threat-intelligence/inside-vidar-2026-from-infection-to-memory-execution-via-jpeg-and-txt-payloads/)
- [Fast, Broad, and Elusive: How Vidar Stealer 2.0 Upgrades Infostealer Capabilities](https://www.trendmicro.com/en_us/research/25/j/how-vidar-stealer-2-upgrades-infostealer-capabilities.html)
- [Vidar Stealer 2.0 Exploits Fake Game Cheats on GitHub, Reddit](https://www.infosecurity-magazine.com/news/vidar-stealer-exploits-github/)
- [Vidar Stealer 2.0 Spreads Through Fake Game Cheats Promoted on GitHub and Reddit](https://cybersecuritynews.com/vidar-stealer-2-0-spreads-through-fake-game-cheats/)
- [Vidar Stealer 2.0: What to know about new infostealer features](https://www.scworld.com/news/vidar-stealer-2-0-what-to-know-about-new-infostealer-features)
- [Vidar Trojan Analysis, Malware Overview by ANY.RUN](https://any.run/malware-trends/vidar/)
- [HHS Vidar Malware Analyst Note (TLP:CLEAR)](https://www.hhs.gov/sites/default/files/vidar-malware-analyst-note-tlpclear.pdf)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0747