Vidar Stealer Weaponizes AutoIt and Masqueraded Scripts

LevelBlue analyzed a multi-stage Vidar Stealer campaign that begins with a trojanized MicrosoftToolkit.exe and a renamed Swingers.dot -> a.bat drop, uses an AutoIt-compiled loader (Replies.scr) and native utilities (e.g., extract32.exe) to reconstruct payloads, and establishes active C2 for exfiltration of browser credentials, cookies, cryptocurrency wallets and other sensitive data; the actors employ self-cleanup to hinder forensics.