Vidar is a credential-stealing trojan that's been active since late 2018. It began as a fork of the earlier Arkei stealer and quickly evolved into one of the more prolific information-theft tools circulating in underground markets. What sets Vidar apart from older stealers is its focus on modern authentication methods—it actively hunts for two-factor authentication tokens, cryptocurrency wallets, browser profiles, and even Tor Browser data. If you're reading this because your antivirus flagged something called "Vidar" or a variant name, understand that this is a serious threat designed to exfiltrate everything an attacker would need to impersonate you online or drain your financial accounts.
Vidar infections typically remain silent. You won't see ransom notes or screen lockers—just quiet data theft in the background. By the time most victims realize something is wrong, their passwords, credit card autofill data, and session cookies have already been uploaded to a remote server. The malware is modular, meaning different campaigns deploy different feature sets, but the core mission is always the same: steal credentials, steal wallets, steal identity.
Threat Profile
| Threat Name | Vidar |
|---|---|
| Type | Information Stealer / Credential Harvester |
| Platform | Windows (PE executable) |
| File Type | Windows PE executable (.exe) |
| Origin / Ancestry | Forked from Arkei stealer (2018) |
| Primary Distribution | Malvertising, phishing emails, software cracks, PUP bundles |
| First Observed | Late 2018 |
| Persistence Mechanism | Run keys, scheduled tasks, or direct execution without persistence (depending on campaign) |
| Data Exfiltration | HTTP POST to attacker C2; uses Telegram API in some variants |
| Targeted Data | Browser credentials, autofill data, cookies, 2FA tokens, cryptocurrency wallets, FTP clients, email clients, Tor Browser profiles |
| Encryption / Obfuscation | Varies by packer; often uses RunPE or process hollowing |
| Known Aliases | Vidar Stealer, Vidar.Stealer (detection names vary by engine) |
How It Spreads
Vidar is distributed through a rotating set of infection vectors, most of them designed to trick you into running the payload yourself. Unlike worms that spread automatically, Vidar relies on social engineering and user error. The most common entry point is malicious advertising—fake download buttons on software sites, fraudulent "update required" pop-ups, or booby-trapped installers for pirated software. Attackers buy ad space on legitimate platforms or compromise smaller sites outright, then serve Vidar-laced executables disguised as installers for popular utilities.
Phishing emails remain a steady distribution channel. These aren't the obviously broken English scams of a decade ago—modern Vidar campaigns use stolen branding, spoofed sender addresses, and context-aware lures ("Your invoice is attached," "Action required on your account"). The attachment or link delivers a loader, often a JavaScript dropper or an Office document with macros, which then fetches and runs the Vidar payload from a remote server.
A third, increasingly common vector is bundling with "cracked" software and key generators. Underground forums and torrent sites are littered with Vidar-infected cracks for Photoshop, AutoCAD, Windows activators, and game cheats. The irony is hard to miss: people trying to avoid paying for software end up paying a much higher price when their bank accounts are drained.
- Malvertising: Fake download buttons, fraudulent software update prompts, compromised ad networks
- Phishing email attachments: ZIP archives, Office docs with macros, PDF links to landing pages
- Software cracks and keygens: Bundled with pirated software, especially Adobe/Autodesk tools and game trainers
- Drive-by downloads: Exploit kits on compromised or malicious websites
- Trojanized installers: Repackaged legitimate software (video converters, system optimizers, browser extensions)
- SEO poisoning: Malicious sites ranked high in search results for popular software downloads
What It Does On Your Machine
Once Vidar executes, it wastes no time. The malware enumerates installed browsers—Chrome, Firefox, Edge, Opera, Brave—and rips out stored passwords, autofill entries, credit card data, and session cookies. It doesn't just grab plaintext; it decrypts the credential databases using each browser's own libraries. Session cookies are especially valuable to attackers because they allow account access without needing the password at all—bypassing even two-factor authentication in many cases.
Vidar also scans for cryptocurrency wallet files. It knows where Electrum, Bitcoin Core, Exodus, Atomic, and dozens of other wallets store their data. If it finds a wallet file, it copies it to the exfiltration bundle. Even encrypted wallets are valuable on the black market—attackers can run offline brute-force attacks or sell the files to other criminals. The malware also hunts for desktop 2FA apps (Authy Desktop, in some variants) and FTP clients like FileZilla, whose saved credentials often provide direct access to web servers.
Some Vidar campaigns deploy additional modules that capture screenshots, scrape Telegram session files, or download secondary payloads like ransomware or cryptominers. The data collection phase typically takes less than 60 seconds. Once complete, the malware compresses everything into a ZIP or RAR archive and uploads it via HTTP POST to the attacker's command-and-control server. In recent campaigns, attackers have switched to using Telegram bots as exfiltration channels, which makes takedown harder and gives them instant notifications when a new victim is compromised.
After exfiltration, Vidar often deletes itself or simply terminates without leaving obvious persistence. Some variants do establish persistence via Run keys or scheduled tasks, especially when deployed alongside other malware families. The lack of visible symptoms is intentional—victims may not realize they're compromised until fraudulent charges appear or accounts are hijacked.
Manual Removal — Step by Step
Disconnect from the internet
Unplug your Ethernet cable or turn off WiFi. This stops any ongoing data exfiltration and prevents the malware from downloading additional payloads or receiving new instructions from the C2 server.
Boot into Safe Mode with Networking
Restart your PC and press F8 (or Shift+F8 on some systems) during boot. Select "Safe Mode with Networking" from the menu. This loads Windows with minimal drivers and prevents most malware from auto-starting.
Run a full scan with updated antivirus software
If you have commercial AV (Bitdefender, Kaspersky, ESET), update definitions and run a full system scan. If you don't have one, download Malwarebytes Free from another clean machine, transfer it via USB, and install/scan offline. Quarantine or delete anything flagged as Vidar or related loaders.
Check browser profile directories manually
Even after AV scans, inspect C:\Users\[YourName]\AppData\Local\Google\Chrome\User Data and similar paths for Firefox, Edge, etc. Look for recently modified files or unfamiliar folders. If anything looks suspicious and wasn't quarantined by your AV, delete the entire browser profile and reconfigure from scratch.
Remove scheduled tasks and startup entries
Press Win+R, type taskschd.msc, and review the Task Scheduler Library. Delete any tasks with random names or suspicious triggers. Then open msconfig and check the Startup tab (or Task Manager → Startup on Windows 10/11). Disable anything unrecognized.
Inspect the Registry for persistence keys
Open regedit and navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run and the equivalent HKEY_LOCAL_MACHINE path. Look for entries with random names or paths pointing to Temp folders. Delete anything that matches Vidar-related filenames your AV flagged earlier.
Clear browser caches and reset sync
Even if you've cleaned the infection, poisoned cookies or autofill data may still be in your profile. Open each browser, clear all history/cache/cookies, and sign out of sync accounts. Re-enable sync only after changing your passwords (see next step).
Change all passwords from a clean device
Do NOT change passwords from the infected machine—even after cleaning, residual keyloggers or undetected malware could capture them. Use a phone, tablet, or known-clean computer to reset passwords for email, banking, social media, and any other accounts. Enable two-factor authentication everywhere possible.
Monitor financial accounts and credit reports
Vidar steals enough data to open accounts in your name or make fraudulent purchases. Check your bank and credit card statements daily for the next few weeks. Consider placing a fraud alert or credit freeze with the major bureaus (Equifax, Experian, TransUnion).
Verify with a second-opinion scanner
After completing the above steps, run a second scan with a different tool—HitmanPro, Emsisoft Emergency Kit, or Kaspersky Virus Removal Tool. Vidar loaders sometimes drop fileless malware or secondary payloads that one engine might miss. If the second scan comes back clean, reboot normally and reconnect to the internet.
Prevention
- Never run executables from untrusted sources. Pirated software, key generators, and "free" versions of paid tools are the single biggest Vidar infection vector. If you didn't download it from the official vendor site, don't run it.
- Use a password manager with auto-fill disabled for sensitive sites. Password managers can still get stolen if Vidar compromises your master password, but they limit exposure by not storing credentials in browser databases. Use KeePass, Bitwarden, or 1Password with a strong master passphrase.
- Enable two-factor authentication everywhere—but use hardware keys or authenticator apps, not SMS. Vidar can steal TOTP secrets from some desktop 2FA apps, but hardware keys (YubiKey, Titan) are nearly impossible to clone remotely.
- Keep browsers and extensions updated. Exploit kits that drop Vidar often rely on outdated browser versions or vulnerable plugins (Flash, Java, old PDFs). Enable automatic updates and remove plugins you don't actively use.
- Run endpoint protection with real-time behavioral monitoring. Free antivirus is better than nothing, but commercial EDR solutions (CrowdStrike, SentinelOne, even Windows Defender for Business) catch more stealer variants through heuristics.
- Segregate your cryptocurrency wallets. Keep large holdings in hardware wallets (Ledger, Trezor) that never connect to your everyday PC. Use desktop wallets only for small transactional amounts.
- Review your browser's saved passwords and purge old accounts. The more credentials you store, the more Vidar can steal. Use your password manager's audit feature to identify and delete unused accounts.
- Train yourself to recognize phishing lures. Vidar thrives on urgency and impersonation. Any unsolicited email with an attachment or link demanding immediate action should be verified through an independent channel (call the company directly, don't reply to the email).
Bring It In
Manual removal of Vidar is time-consuming and error-prone. Miss one registry key, one scheduled task, or one secondary payload, and the infection persists—or worse, a backdoor re-downloads the stealer days later. Our technicians have cleaned hundreds of credential-stealer infections, and we use forensic-grade tools that go far beyond consumer antivirus. We'll scrub your machine, verify that no data is still being exfiltrated, and give you a printed report of what was found and what we did to fix it. If your banking information or cryptocurrency wallets were accessed, we'll walk you through the next steps with your financial institutions.
We're located in Roswell, Georgia, and we handle both walk-ins and drop-offs. Call us at (770) 856-1202 to describe your symptoms, or just bring the machine in—we'll run a free diagnostic to confirm whether you're dealing with Vidar or another threat. Turnaround is typically same-day or next-day, depending on the severity of the infection. Don't gamble with your credentials and your financial safety. Let us handle it.