Vidar Uses Victims’ Own Browsers to Extract Data Protected by Browser Encryption

Cybercriminals are exploiting GTA 6 hype by hosting fake Rockstar demo websites that distribute a 1.1 MB executable which is the Vidar infostealer; the malware harvests saved passwords, cookies, session tokens, browsing history and other profile data from many browsers by launching legitimate browser processes in headless mode to bypass browser encryption. The report includes distribution domains (e.g., gta6demo.asia, gta6demo.eu) and explains the attack vector and impact of short-lived infostealer execution.