# Access-Code-Gated Phishing Chain Delivers Vidar Infostealer via DocuSign Impersonation

> A DocuSign-impersonating phishing campaign delivers a code-signed .NET first-stage installer (DocuSign_PackageInstaller.exe) that will not release its second stage until an operator-supplied access code is validated by a C2 registration endpoint. The second stage is a packed native binary that gates execution on an online (non-local) time check before unpacking and deploying the Vidar infostealer.

- **Published:** 2026-09-12T00:00:00Z
- **Last reviewed:** 2026-09-12T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2456
- **ID:** TL-2026-2456
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 17 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Joe Security documented a multi-stage malware delivery chain that impersonates DocuSign to distribute the Vidar infostealer. The attack begins with a phishing email pointing victims to a lookalike page at docu.sign-platform.app, which serves DocuSign_PackageInstaller.exe — a single-file .NET bundle carrying a valid PE code-signing certificate issued to a China-based organization. The installer contains signature- and access-code-verification logic: it transmits an operator-entered access code to a registration endpoint at 185.153.198.115/api/submit, and only downloads the second-stage payload once the C2 server validates that code. This access-code gate is specifically designed to block both automated sandboxes and manual analysts who lack a valid code.

Joe Reverser bypassed this gate through static analysis alone, recovering the second-stage native binary without ever satisfying the runtime access-code check. That binary contains an early time-bomb check that is deliberately built to query an online time source rather than the local system clock, defeating the common sandbox-analysis technique of rolling back or manipulating the local clock to skip time-gated logic. After the time check passes, classic packing is used as an additional obfuscation layer before the payload unpacks into the Vidar infostealer, a commodity credential- and browser-data-stealing malware family that exfiltrates harvested data to its operators. A set of dropzone paths on training-vibe.forum (covering PE, DLL, Python, PowerShell, and batch-script archives) was documented as staging infrastructure for stealer components.

No CVE or CVSS applies — this is a social-engineering and malware-delivery chain, not a software vulnerability. Its significance is the layered evasion design: a paid-for/abused valid code-signing certificate, a C2-gated access-code check that blocks offline/sandbox analysis, and an online (not local) time-based anti-sandbox trigger that resists clock manipulation.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1588 Obtain Capabilities
- T1566 Phishing
- T1204 User Execution
- T1553 Subvert Trust Controls
- T1036 Masquerading
- T1480 Execution Guardrails
- T1497 Virtualization/Sandbox Evasion
- T1027 Obfuscated Files or Information
- T1555 Credentials from Password Stores
- T1005 Data from Local System
- T1071 Application Layer Protocol

## Sources

- [Deep Malware and Phishing Analysis - Breaking Down an Access-Code-Gated Malware Delivery Chain](https://www.joesecurity.org/blog/8930920806197220285)
- [What Is an Infostealer? How Credential-Stealing Malware Works](https://www.sentinelone.com/cybersecurity-101/cybersecurity/infostealer/)
- [Vidar Stealer: Malware Evolution & Acronis Defenses](https://www.acronis.com/en/tru/threat-catalog/malware/infostealers/vidar/)
- [Fast, Broad, and Elusive: How Vidar Stealer 2.0 Upgrades Infostealer Capabilities](https://trendmicro.com/en_us/research/25/j/how-vidar-stealer-2-upgrades-infostealer-capabilities.html)
- [Anomali Cyber Watch: ROBOT Malware, GlassWorm, Vidar Stealer 2.0](https://www.anomali.com/blog/anomali-cyber-watch-robot-malware-suite-glassworm-vidar-stealer-2-0)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2456