Vidar Infostealer Being Spread through Phishing Emails

Vidar infostealer campaigns in the first half of 2026 continue targeting Korean users through phishing emails with malicious attachments masquerading as Word documents. The malware employs a Go-based packer and uses Dead Drop Resolver techniques leveraging Telegram and Steam profiles to retrieve command and control addresses. It incorporates anti-debugging and anti-VM techniques to evade analysis. Vidar exfiltrates extensive sensitive information such as browser credentials, cookies, browsing history, cryptocurrency wallet data, Discord and Telegram tokens, Steam data, Azure credentials, and screenshots. The malware downloads configuration data in JSON format to control its data collection activities based on received flags and additional conditions. No CVE or patch information is available, and no known exploits in the wild are reported.

Successful infection results in theft of a broad spectrum of sensitive user data including authentication credentials for browsers, cryptocurrency wallets, communication platforms (Discord, Telegram), gaming accounts (Steam), cloud services (Azure), and screenshots. This data theft can lead to account compromise, financial loss, privacy violations, and further targeted attacks. The malware’s use of anti-analysis techniques complicates detection and mitigation efforts.

No official patch or fix is available for this malware as it is distributed via phishing campaigns rather than exploiting software vulnerabilities. Mitigation should focus on user awareness to avoid opening suspicious email attachments, especially those disguised as Word documents but are executables. Employ email filtering and endpoint protection solutions capable of detecting and blocking Vidar-related indicators such as known malicious domains and file hashes. Monitor for indicators of compromise provided by threat intelligence sources. Since this is not a software vulnerability, patching is not applicable.