Threats Tagged 'dead drop resolver'

Vidar is a Malware-as-a-Service infostealer active since 2018, currently distributed via phishing emails targeting Korea in early 2026. The phishing emails impersonate job applications and copyright infringement notices, delivering executables disguised as Word documents. Vidar uses advanced techniques such as a Go-based packer, Dead Drop Resolver via Telegram and Steam profiles for command and control, and anti-debugging and anti-VM measures. It steals a wide range of sensitive data including browser credentials, cookies, cryptocurrency wallets, Discord and Telegram tokens, Steam data, Azure credentials, and screenshots. Configuration is dynamically downloaded in JSON format, guiding data collection based on flags and conditions.

A malicious Go module masquerading as a DNS/subdomain scanner has been identified as part of a sophisticated Windows malware staging operation named 'Muck and Load'. This operation uses a large GitHub-based infrastructure of 222 repositories across 190 accounts, employing automated workflows to appear legitimate. The malicious module downloads encoded PowerShell scripts that retrieve encrypted payloads from public platforms like Pastebin and Telegram. These payloads include well-known malware such as AsyncRAT, Quasar, Remcos, and Vidar infostealers, which are executed from disguised Microsoft-themed directories. At least 14 malware files have been confirmed within this network.