Vidar Infostealer Adds Custom VM and Per-Build Stream Ciphers for String Obfuscation

Key facts

Detection coverage

As of 2026-11-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5572 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Vidar ClickFix - Explorer-Spawned Shell With Download Cradle (T1204.004)

Detects powershell, pwsh, mshta or cmd launched directly by explorer.exe with a download-and-execute or encoded command line. This is the Run-dialog paste pattern used by ClickFix lures that deliver the Vidar infostealer (TL-2026-5572, T1204.004). The behaviour is independent of Vidar's per-build string obfuscation, so it survives rebuilds.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1204.004, T1059.001
• Data sources: sysmon (index=sysmon, XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode 1), microsoft_defender_for_endpoint DeviceProcessEvents
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentImage="*\\explorer.exe" (Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\mshta.exe" OR Image="*\\cmd.exe")
| where match(CommandLine, "(?i)(invoke-expression|downloadstring|invoke-webrequest|(^|[\s;&|])iex\s|(^|\s)iwr\s|mshta(\.exe)?\s+https?://|curl(\.exe)?\s.*https?://|-enc(odedcommand)?\s)")
| stats count min(_time) as firstTime max(_time) as lastTime values(CommandLine) as commandlines by Computer User ParentImage Image
| convert ctime(firstTime) ctime(lastTime)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "explorer.exe"
| where FileName in~ ("powershell.exe", "pwsh.exe", "mshta.exe", "cmd.exe")
| where ProcessCommandLine matches regex @"(?i)(invoke-expression|downloadstring|invoke-webrequest|(^|[\s;&|])iex\s|(^|\s)iwr\s|mshta(\.exe)?\s+https?://|curl(\.exe)?\s.*https?://|-enc(odedcommand)?\s)"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| order by Timestamp desc

Sigma

title: Vidar ClickFix - Explorer-Spawned Shell With Download Cradle
id: 7c1e5a42-3b8d-4f1a-9a6e-2d4b8c0f1e11
status: experimental
description: Detects a shell or mshta process launched directly by explorer.exe (Win+R Run dialog paste, ClickFix lure) with a download-and-execute command line, a documented Vidar infostealer delivery path (T1204.004). TL-2026-5572.
references:
    - https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation
    - https://www.acronis.com/en/tru/threat-catalog/malware/infostealers/vidar/
author: Threadlinqs Team
date: 2026-11-09
tags:
    - attack.execution
    - attack.t1204.004
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\explorer.exe'
    selection_image:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\mshta.exe'
            - '\cmd.exe'
    selection_cli:
        CommandLine|contains:
            - 'Invoke-Expression'
            - 'iex '
            - 'iex('
            - 'DownloadString'
            - 'Invoke-WebRequest'
            - 'iwr '
            - 'mshta http'
            - 'curl '
            - '-EncodedCommand'
            - ' -enc '
    condition: all of selection_*
falsepositives:
    - Administrators or users launching legitimate PowerShell one-liners from Explorer shortcuts
    - Software installers or bootstrap scripts started from Explorer
level: high

Known false positives:

• Administrators or users launching legitimate PowerShell one-liners from Explorer shortcuts
• Software installers or bootstrap scripts started from Explorer that use Invoke-WebRequest or curl

Tuning notes: Allow-list known internal script hosts and signed installers by CommandLine or URL domain. Require an external URL in the command line to lower noise. Pair with the RunMRU detection (TL-2026-5572-KQL-001) to confirm Run-dialog origin.

• 🔒 Vidar ClickFix - Suspicious Command Typed Into Run Dialog (RunMRU) · unlock with TL Creds
• 🔒 Vidar - Remote Thread Injection Into Browser From User-Writable Path · unlock with TL Creds
• 🔒 Vidar - HTTP POST to Root URI With Empty User-Agent (Exfiltration) · unlock with TL Creds
• 🔒 Vidar Infostealer - Known Zscaler-Reported Sample Hashes (v2.0-v3.4) · unlock with TL Creds
• 🔒 Vidar - Browser Credential and Cookie Store Read by Non-Browser Process · unlock with TL Creds
• 🔒 Vidar-Related Community-Observed Infrastructure - DNS Lookup · unlock with TL Creds
• 🔒 Vidar - Chromium Browser Launched in Debug Mode by Non-Browser Process · unlock with TL Creds
• 🔒 Vidar - Dead Drop Resolver Lookup by Non-Browser Process (Telegram, Steam, Mastodon) · unlock with TL Creds

Indicators of compromise

As of 2026-11-09, Threadlinqs Intelligence tracks 10 indicators of compromise for TL-2026-5572.

Sample indicators (3 of 10)

• Domain: ieji[.]de
• File hash: 1628bb03db87f67661349e169d73ee14ed490bdbf22abfbda08ccc9ebe237974
• Domain: koyu[.]space

Defanged, TLP:CLEAR. Full set of 10 indicators: unlock with TL Creds.

Technical analysis

Vidar is a commodity infostealer first observed in 2018 (reported by Acronis TRU as a fork of Arkei). Zscaler ThreatLabz (analysis of samples from May to early September 2026, published 2026-09-21) tracks how the family's string obfuscation has changed. Early builds used single-byte XOR. Internal v1.5 adopted ChaCha20 and v1.8 modified it with different quarter-round rotations. Internal v2.0 introduced two per-build features: a custom virtual machine and a custom stream cipher. Zscaler first observed the VM in June 2026.

The VM is a fetch-decode-execute bytecode interpreter with a sparse 256-entry dispatch table in which unused slots are null and terminate execution. It has 14 populated opcode handlers, no stack, and a single one-byte accumulator. Its primitives are XOR, addition, subtraction, rotation, bitwise NOT, multiplication and S-box substitution. Opcodes, constants and substitution tables vary per build. A hardcoded 4-byte XOR key also seeds the accumulator. The VM decodes some strings directly and also decrypts the key and nonce for the stream cipher: in v2.0 and v2.1 the first 9 bytes are the key, from v2.2 the first 8 bytes are the key, and in all versions the last 4 bytes are the nonce.

Two stream cipher families are described. v2.0 and v2.1 use a modified ChaCha with a custom 128-bit initial state, an 8-byte key, a 4-byte nonce and varying quarter-round rotations. v2.2 and later use an ARX design: the key is absorbed with FNV-1a multiplication using a per-build seed constant, the nonce is absorbed with the constant 0x9E3779B9, and each keystream byte comes from add-rotate-XOR steps with per-build constants, folded to one byte and XORed with the ciphertext. Decoded strings include loader status messages (for example 'Loader: write failed'), browser/wallet/plugin counters from a 'grabber' component, an HWID error message and an HTTP Accept header string.

The Zscaler post does not describe C2, delivery or data theft in detail. Other vendor reporting (Acronis TRU) describes Vidar 2.0 (released 2025-10-06) as using dead drop resolvers on Mastodon, Telegram and Steam profiles that encode the current C2 IP, exfiltrating via HTTP POST with empty User-Agent and Host headers and URI '/', stealing browser credentials, cookies, 2FA tokens and crypto wallets, and being delivered through malvertising, GitHub release abuse, ClickFix/FileFix lures and fake game cheats. Note that Zscaler's internal version numbering may not map one-to-one to other vendors' labels. The Zscaler text names v3.3 as the latest, but its IOC table lists a v3.4 sample. Severity is analyst-assigned because the source gives none. No CVE, CVSS or actor attribution is stated.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1560 Archive Collected Data

Defense Evasion

T1027 Obfuscated Files or Information; T1027.001 Obfuscated Files or Information: Binary Padding; T1055 Process Injection; T1070.004 Indicator Removal: File Deletion; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1102.001 Web Service: Dead Drop Resolver

Discovery

T1082 System Information Discovery

Execution

T1204.004 User Execution: Malicious Copy and Paste

Credential Access

T1539 Steal Web Session Cookie; T1555.003 Credentials from Password Stores: Credentials from Web Browsers

Remediation

Immediate actions

• Hunt for the listed SHA-256 hashes across EDR and file telemetry
• Alert on non-browser processes making HTTPS requests to Telegram, Steam community profile or Mastodon pages
• Alert on HTTP POSTs with empty User-Agent and Host headers and URI '/'
• Reset credentials, revoke sessions and rotate tokens for any user on a host where Vidar is confirmed

Workarounds

• Block or monitor shortened-URL and dead-drop-resolver platform access from servers and non-browser processes where not business-required

Longer-term hardening

• Deploy EDR with behavioral detection for browser credential-store access by unusual processes
• Restrict software installs from unvetted sources and block pasting commands into the Run dialog via user training and policy
• Do not rely on static string signatures because strings are re-encrypted per build

Affected and fixed versions

• Microsoft — Windows
  Vulnerable versions: Windows endpoints running web browsers, crypto wallets and 2FA apps targeted by Vidar

Timeline

• 2018-12-01 Vidar emerges in late 2018 as a fork of Arkei, per Acronis TRU (month approximate).
• 2025-10-06 Vidar 2.0 released, per Acronis TRU, with dead drop resolver C2 via Mastodon/Telegram/Steam and browser-process injection to bypass AppBound encryption.
• 2025-11-01 Vidar reported as the top infostealer on the Russian Market (November 2025, month approximate).
• 2026-03-17 Acronis TRU reports Vidar Stealer 2.0 distributed via fake game cheats on GitHub and Reddit.
• 2026-04-24 Intrinsec publishes TLP:CLEAR 'New Vidar' report on a new version, including dead drop resolver C2 recovery and control flow flattening (per search snippet; body not readable).
• 2026-06-01 Zscaler ThreatLabz first observes the per-build custom VM in Vidar samples (June 2026, month approximate).
• 2026-09-21 Zscaler ThreatLabz publishes analysis of Vidar VM and custom stream ciphers across internal versions 2.0 to 3.3, with sample hashes up to v3.4.

Sources cited

• Vidar Stealer 2.0 distributed via fake game cheats on GitHub and Reddit (Hive Pro) hivepro.com · Advisory
• Vidar Adds Virtual Machine and Custom Stream Ciphers For String Obfuscation (Zscaler ThreatLabz) zscaler.com · Research · 2026-09-21
• Zscaler ThreatLabz Threat Library: Win32.PWS.Vidar threatlabz.zscaler.com · Vendor report
• Vidar Stealer threat catalog (Acronis TRU) acronis.com · Research
• TLP:CLEAR New Vidar (Intrinsec) intrinsec.com · Research · 2026-04-24
• Infostealer Malware Vidar distributed via the Steam store (SECUINFRA) secuinfra.com · Blog
• Vidar Malware: How the Multithreaded Windows Stealer Works (Picus Security) picussecurity.com · Blog
• Vidar distributed through backdoored Windows 11 downloads and abusing Telegram (Zscaler, via Security Boulevard) securityboulevard.com · News · 2022-05-01

More in malware

• Exvicy: ClickFix MaaS Framework Copycat of ErrTraffic Distributing Malware via Compromised WordPress Sites
• Blind Eagle (APT-C-36) Uses Fake Court Notices to Deliver AsyncRAT/DCRat-Lineage RAT Across Latin America
• GhostFrame: New ESXi Post-Exploitation Implant Linked to TAG-218 / Settra Ransomware
• Formbook (XLoader) Campaign Targets European Manufacturing and Technology Businesses with Localized Order Lures
• iVerify Advanced Mobile Threat Report 2026: Mobile Spyware Shifts Toward Everyday Users as Criminal Groups Fork Leaked iOS Exploit Kits for Credential and Crypto Theft

Previous and next in malware

• Remus Infostealer 1.3.9 Markets Persistent Gmail Access Feature (Enterprise Tier) Previous report
• Abe Office (AbeAgent.exe): Signed Modular RAT/Stealer Bypassing Chrome and Edge App-Bound Encryption via Hidden-Desktop Browser and Elevation Service Abuse Next report