New Vidar Malware Campaign Uses Fake YouTube Software Downloads to Steal Corporate Credentials

Key Takeaways

• A new campaign leveraging the Vidar information stealer is actively targeting corporate employees, distributing malware through deceptive YouTube software downloads.
• Vidar is designed to harvest a wide array of sensitive data, including login credentials, browser cookies, credit card details, and cryptocurrency wallet files from various web browsers.
• The attack chain employs sophisticated evasion techniques, such as fake code-signing certificates and a Dead Drop Resolver mechanism for C2 communication, making detection and analysis challenging.
• Organizations are strongly advised to implement robust employee training, enforce multi-factor authentication, and deploy advanced network security measures to mitigate the threat.

Vidar, an increasingly prevalent information-stealing malware, has emerged as a significant threat to corporate environments in early 2026. Threat actors are deploying sophisticated social engineering tactics, primarily through fake software downloads promoted via YouTube videos, to compromise employee workstations.

This widespread campaign aims to exfiltrate critical data, including corporate login credentials, web browser data, and cryptocurrency wallet information, posing substantial risks to organizational security. The sheer scale and targeted nature of these attacks have drawn considerable attention from cybersecurity researchers globally.

The Rise of Vidar and its Evolution

Vidar’s ascendancy is not an isolated event but rather a consequence of shifts in the cybercrime landscape. Throughout 2025, international law enforcement efforts successfully disrupted the infrastructure of two prominent infostealers, Lumma and Rhadamanthys. This created a void, prompting cybercriminals to seek reliable alternatives.

Capitalizing on this opportunity, Vidar’s operators launched Vidar version 2.0 in October 2025. This updated iteration introduced enhanced capabilities and improved evasion techniques, quickly establishing Vidar as the leading stealer on the Russian Market, as measured by the monthly volume of stolen logs uploaded.

Intrinsec Uncovers the Kill-Chain

Analysts at Intrinsec identified a complete kill-chain during an investigation into a Vidar compromise affecting a corporate employee at one of their client organizations. Their analysis revealed that the attack originated with a YouTube video promoting a fabricated software tool named “NeoHub.”

The unsuspecting victim followed a link provided in the video, which led them through a file-sharing site before ultimately downloading a malicious archive from Mediafire. The entire process was meticulously crafted to mimic a legitimate software installation.

The impact of this campaign extends beyond individual employees. Vidar has been adopted by a diverse range of threat actors, from opportunistic individuals to sophisticated organized groups like Scattered Spider. The Cybersecurity and Infrastructure Security Agency (CISA) has even included Vidar in security advisories detailing tools utilized by such groups. Stolen credentials are subsequently traded on the Russian Market, placing corporate networks and internal accounts at severe risk.

The malware specifically targets popular web browsers such as Chrome, Firefox, Edge, Opera, Vivaldi, Waterfox, and Palemoon. It systematically collects sensitive data including passwords, cookies, credit card information, and cryptocurrency wallet files.

The Infection Mechanism: A Carefully Staged Attack

The kill-chain employed in this Vidar campaign is meticulously designed to evade suspicion at every stage. Upon downloading the archive from Mediafire, victims encounter what appears to be a standard software package. The most prominent file, “NeoHub.exe,” masquerades as a legitimate installer.

However, this executable covertly loads a second file, “msedge_elf.dll,” which contains the actual Vidar payload. These two files work in concert to initiate the infection silently. The “msedge_elf.dll” file is crafted to impersonate a genuine Microsoft Edge browser component, making it difficult to detect during a cursory review.

Adding another layer of authenticity, the malicious DLL was signed using a counterfeit code-signing certificate. Early versions impersonated GitHub under the name “githab.com,” while later iterations mimicked grow.com. Both certificates have been linked to multiple other malicious files, suggesting either a shared threat actor or the use of a third-party service for generating fraudulent signatures.

The malicious DLL is further obfuscated using a GO-based packer that employs unusual section names and control flow flattening. This technique deliberately disrupts the natural structure of the code, significantly complicating analysis by security tools and human analysts.

Once active on a victim’s system, Vidar utilizes a Dead Drop Resolver to locate its command-and-control (C2) server. Instead of hardcoding C2 addresses, the malware embeds the server’s true location within public Steam profiles and Telegram channels. This method allows attackers to rapidly rotate their infrastructure without needing to update the malware itself, enhancing resilience and evasion capabilities.

What You Should Do

• Employee Training: Conduct regular security awareness training to educate employees about the dangers of downloading software from unverified sources, especially through YouTube video links or unknown file-sharing websites.
• Multi-Factor Authentication (MFA): Implement and enforce MFA for all corporate accounts and browser-linked services to significantly reduce the risk of credential theft.
• Network Monitoring: Establish robust network monitoring to detect unusual outbound connections to unknown C2 servers and block malicious domains and IP addresses using published indicators of compromise (IoCs).
• Secure Web Gateways and DNS Filtering: Deploy Secure Web Gateways and DNS filtering solutions to prevent users from accessing malicious websites and block deceptive redirections.
• Sandboxing: Utilize sandboxing technologies to isolate and analyze downloaded files before execution, adding a critical layer of defense against unknown or suspicious payloads.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.