Vidar Stealer 2.0 Spreads via Fake Game Cheats Shared on GitHub and Reddit

Large-scale campaigns are abusing GitHub, Reddit and Discord to distribute Vidar Stealer 2.0 via fake “free game cheats” and sideloaded installers; operators hide payloads behind images and third-party redirects, use GitHub Pages and password-protected archives, and employ loaders (PowerShell-in-.NET, AutoIt, VBS) that deploy a Themida-packed Vidar 2.0 which harvests browser credentials, cookies, crypto wallets, Azure tokens, Steam/Discord/Telegram artifacts and exfiltrates via Telegram/Steam dead drops — the report highlights extensive evasion (morphing, obfuscation, sandbox checks), widespread targeting of gamers (including minors), and recommends treating gaming-related downloads and unapproved executables as high-risk.