New Vidar Stealer Campaign Targets User Credentials

Researchers at the Genians Security Center uncovered a sophisticated APT37-linked campaign that uses tailored spear-phishing ZIP attachments containing malicious LNK shortcuts to execute obfuscated multi-stage payloads. The chain downloads a BAT which retrieves a legitimate Python embed, renames pythonw.exe to run a stealthy Python-based RAT (Vidar-like) that communicates with C2 servers, enabling credential theft, file exfiltration, and secondary payload deployment; the report includes C2 domains, an IP, and a payload filename as IOCs.