Access-Code-Gated Phishing Chain Delivers Vidar Infostealer via DocuSign Impersonation
Access-Code-Gated Phishing Chain Delivers Vidar Infostealer (TL-2026-2456) is a high-severity malware campaign, first published 2026-09-12. It has no confirmed attribution, maps to 12 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 17 indicators of compromise.
Key facts for TL-2026-2456
- Threat ID
- TL-2026-2456
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-09-12
- Last reviewed
- 2026-09-12
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Detection rules
- 9
- Indicators of compromise
- 17
Malware and tooling in Access-Code-Gated Phishing Chain Delivers Vidar Infostealer
Malware and tooling: Vidar
A DocuSign-impersonating phishing campaign delivers a code-signed .NET first-stage installer (DocuSign_PackageInstaller.exe) that will not release its second stage until an operator-supplied access code is validated by a C2 registration endpoint. The second stage is a packed native binary that gates execution on an online (non-local) time check before unpacking and deploying the Vidar infostealer.
How Access-Code-Gated Phishing Chain Delivers Vidar Infostealer works
Joe Security documented a multi-stage malware delivery chain that impersonates DocuSign to distribute the Vidar infostealer. The attack begins with a phishing email pointing victims to a lookalike page at docu.sign-platform.app, which serves DocuSign_PackageInstaller.exe — a single-file .NET bundle carrying a valid PE code-signing certificate issued to a China-based organization. The installer contains signature- and access-code-verification logic: it transmits an operator-entered access code to a registration endpoint at 185.153.198.115/api/submit, and only downloads the second-stage payload once the C2 server validates that code. This access-code gate is specifically designed to block both automated sandboxes and manual analysts who lack a valid code.
Joe Reverser bypassed this gate through static analysis alone, recovering the second-stage native binary without ever satisfying the runtime access-code check. That binary contains an early time-bomb check that is deliberately built to query an online time source rather than the local system clock, defeating the common sandbox-analysis technique of rolling back or manipulating the local clock to skip time-gated logic. After the time check passes, classic packing is used as an additional obfuscation layer before the payload unpacks into the Vidar infostealer, a commodity credential- and browser-data-stealing malware family that exfiltrates harvested data to its operators. A set of dropzone paths on training-vibe.forum (covering PE, DLL, Python, PowerShell, and batch-script archives) was documented as staging infrastructure for stealer components.
No CVE or CVSS applies — this is a social-engineering and malware-delivery chain, not a software vulnerability. Its significance is the layered evasion design: a paid-for/abused valid code-signing certificate, a C2-gated access-code check that blocks offline/sandbox analysis, and an online (not local) time-based anti-sandbox trigger that resists clock manipulation.
MITRE ATT&CK techniques used in TL-2026-2456
Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1480 Execution Guardrails; T1497 Virtualization/Sandbox Evasion
Command and Control
T1071 Application Layer Protocol
Execution
defense-impairment
Credential Access
T1555 Credentials from Password Stores
Initial Access
Resource Development
Remediation for Access-Code-Gated Phishing Chain Delivers Vidar Infostealer
Immediate actions
- Block network indicators docu.sign-platform.app, 185.153.198.115, and training-vibe.forum at DNS/proxy/firewall
- Hunt EDR and proxy logs for execution of DocuSign_PackageInstaller.exe or index.exe and for outbound requests to /api/submit?code=
- Alert on and quarantine the documented first- and second-stage file hashes across the fleet
Workarounds
- Restrict execution of unsigned or newly observed installer packages delivered via email links through application allowlisting
- Block or inspect outbound HTTP to raw IP-literal endpoints from end-user workstations where feasible
Longer-term hardening
- Deploy behavioral EDR detection for execution-guardrail patterns: installers that wait on a server-validated secret before fetching a second payload
- Do not treat a valid code-signing signature alone as a trust signal; enforce certificate-issuer reputation/allowlisting given confirmed abuse of a validly issued certificate
- Run user-awareness training on DocuSign-branded phishing and lookalike e-signature domains, since the lure requires no vulnerability, only user trust
Timeline of Access-Code-Gated Phishing Chain Delivers Vidar Infostealer
- Joe Security publishes the technical writeup 'Breaking Down an Access-Code-Gated Malware Delivery Chain' documenting the full chain and IOCs.
- Dropzone infrastructure at training-vibe.forum, with PE/DLL/Python/PowerShell/batch archive paths, is documented as staging for stealer components.
- The unpacked payload is confirmed to be the Vidar infostealer.
- Classic packing is documented as an additional obfuscation layer applied to the second-stage payload.
- An early time-bomb check in the second-stage binary is found to query an online time source rather than the local system clock, defeating local clock manipulation.
- Joe Reverser extracts the second-stage native binary (index.exe) via static analysis alone, bypassing the runtime access-code requirement.
- Access-code submission is traced to a registration endpoint at 185.153.198.115/api/submit?code={CODE}; the second stage is released only after server-side validation.
- Analysis of DocuSign_PackageInstaller.exe reveals a code-signed .NET single-file bundle carrying signature- and access-code-verification logic gating the second stage.
- Joe Security identifies a DocuSign-themed phishing page at docu.sign-platform.app serving a fraudulent installer, DocuSign_PackageInstaller.exe.
Sources cited for Access-Code-Gated Phishing Chain Delivers Vidar Infostealer
- Deep Malware and Phishing Analysis - Breaking Down an Access-Code-Gated Malware Delivery Chain
- What Is an Infostealer? How Credential-Stealing Malware Works
- Vidar Stealer: Malware Evolution & Acronis Defenses
- Fast, Broad, and Elusive: How Vidar Stealer 2.0 Upgrades Infostealer Capabilities
- Anomali Cyber Watch: ROBOT Malware, GlassWorm, Vidar Stealer 2.0
More in malware
- Multi-Stage Cobalt Strike Loader Deploys Stageless Beacon via Anti-Sandbox .NET Chain
- ScarfaceStealer: Electron-Delivered Infostealer with Sandbox-Scoring Evasion and Smart-Contract C2
- Gigabud Android Banking Trojan Clones Banking Apps via Hidden Work Profile (Vwork/GoldFactory)
- LegionLoader Malware Distributed via Fake Cloudflare CAPTCHA Using the ClickFix Technique
- SloppyRAT: New Remote Access Trojan Deployed via ClickFix in Ransomware-Linked Attacks
Detection coverage for TL-2026-2456
As of 2026-09-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2456 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-2456
2 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.