Vidar Rises to Top of Chaotic Infostealer Market

Intrinsec reports that Vidar, an infostealer active since 2018, has surged to the top of the infostealer ecosystem after upgrades and expanded distribution following law-enforcement takedowns of competitors; attackers are using phishing, trojanized packages, fake game cheats and Telegram "cloud" channels to spread it. Vidar harvests saved passwords, cookies, session tokens, browser-stored crypto wallets, email client data, screenshots and local files, uses dead-drop resolvers to hide C2, and its stolen credentials are monetized on underground markets; recommended defenses include MFA for browser accounts, DNS filtering/secure web gateways, and sandboxing of attachments and URLs.