Vidar Adds Virtual Machine and Custom Stream Ciphers For String Obfuscation

Vidar is an information stealer first observed in 2018 that has continuously evolved its string obfuscation techniques to evade detection and analysis. Between May and September 2026, the malware progressed from basic XOR encryption to ChaCha20-based algorithms, and most recently implemented a custom virtual machine executed via a lightweight bytecode interpreter combined with custom stream ciphers that change per build. The VM uses 14 opcode handlers with simple primitives including XOR, addition, rotation, and substitution. Version 2.0 introduced this VM approach, while versions 2.2 and later added ARX-based custom stream ciphers using FNV-1a hashing and golden ratio constants. These per-build variations in opcodes, constants, and substitution tables significantly hinder static and automated analysis capabilities.

• 2CLoader: A New Malware Loader Delivering Vidar and RemusMalware2026-09-30
• Peeling Back the Layers: Inside Vidar · From Virtualized Code to Stolen CredentialsMalware2026-09-09
• Aurora ransomware targets ESXi abuses Cursor Agent for exploitationMalware2026-10-29
• September 2026 Infostealer Trend ReportMalware2026-10-28
• The Gentlemen: A closer look at a not-so-gentle ransomware-as-a-service operationMalware2026-10-21