New Vidar 2.0 Infostealer Spreads via Fake Game Cheats on GitHub, Reddit

Acronis TRU researchers uncovered a large campaign that distributes Vidar 2.0—an actively sold infostealer—through social platforms and GitHub pages disguised as free game cheats. Vidar 2.0 has been rewritten for greater speed and stealth, uses PowerShell droppers and persistence, detects and avoids analysis environments, exfiltrates cryptocurrency wallets, Discord/Steam/Telegram tokens, cloud and server credentials (e.g., Azure, FileZilla), takes screenshots, and uses Telegram bots and Steam profiles as covert command/dead-drop channels; hundreds of malicious pages were found and the true scale may be much larger.