MALWARE FAMILY

Vidar

Internal ID: win.vidar

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.

Threat Analysis

Vidar is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/

→https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/

→https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign

→https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/

→https://asec.ahnlab.com/en/22932/

→https://asec.ahnlab.com/en/30445/

→https://asec.ahnlab.com/en/30875/

→https://asec.ahnlab.com/ko/25837/

→https://aviab1.github.io/Vidar-Stealer/

→https://aviab1.github.io/blog/vidar-stealer/

Quick Facts

TypeMalware Family

Aliases1

Also Known As

win.vidar

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Vidar