What is Vidar Stealer?
Updated
What makes Vidar different
While most infostealers focus primarily on browser data, Vidar includes a file grabber that searches for and exfiltrates specific file types from the infected device. This can include documents, spreadsheets, configuration files, and database exports. This makes Vidar particularly dangerous for organisations handling sensitive files on devices that may become infected.
Ransomware connection
Vidar has been observed as a precursor to ransomware attacks. In some campaigns, Vidar is deployed first to steal credentials and map the environment, followed by ransomware deployment using the access gained through the stolen data. This makes Vidar infections a potential early warning sign of more severe attacks.
What Vidar steals
Vidar targets browser credentials, cookies, cryptocurrency wallets, clipboard data, and, uniquely, local files matching configurable patterns. It also captures system information, installed software, and screenshots.
How Passguard detects Vidar
Passguard monitors the criminal marketplaces and Telegram channels where Vidar logs are traded. When infected devices containing access to your organisation's systems are listed for sale, Passguard alerts your security team with the details needed to act: device information, malware type, compromised sessions, and infection timeline.
Detect infostealers with Passguard
See if your organisation appears in stealer logs and criminal marketplaces.