Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Infostealer

Vidar Stealer

Infostealer 32 detections found

Also known as: Vidar, Vidar Trojan, Vidar Malware

Vidar is a Windows information-stealing trojan first observed in late 2018, derived from the Arkei stealer lineage and sold/rented on dark-web and underground forums for use by a range of threat actors. It is commonly distributed through malvertising, phishing, and cracked-software/pirated-game lures, and targets browser credentials, credit card data, cryptocurrency wallets, and FTP client credentials. No law-enforcement takedown has occurred; Vidar remains actively developed, with a revamped "Vidar 2.0" and Go-based loader/builder frameworks (e.g., "Factory-v3") observed in 2025-2026 campaigns that also abuse stolen code-signing certificates to evade detection.

Detection & eradication references

Curated links to authoritative sources — MITRE ATT&CK, CISA advisories, law-enforcement takedown announcements, and vendor threat-intel writeups — for removal, remediation, and further technical detail. Sigma Watch does not publish its own removal steps here, since malware behavior and tooling change too fast for a static write-up to stay reliably accurate.

Detection rules

Source Rule Status Updated
splunk Windows Cloud Sensitive File Read Access By Uncommon Process production 2026-08-19
snort ET TROJAN Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 rev 1 2025-01-17
suricata ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 rev 1 2025-01-17
snort ET RETIRED Vidar Stealer CnC Checkin rev 2 2024-09-30
suricata ET RETIRED Vidar Stealer CnC Checkin rev 3 2024-09-30
suricata ET MALWARE Vidar Stealer Form Exfil rev 1 2024-07-15
snort ET TROJAN Vidar Stealer Form Exfil rev 1 2024-07-15
suricata ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil rev 4 2024-04-29
suricata ET MALWARE Win32/Vidar Variant/Mars Stealer CnC Exfil rev 3 2024-04-28
suricata ET MALWARE Arkei/Vidar/Mars Stealer Variant rev 4 2024-04-03
snort ET TROJAN Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 rev 1 2024-03-28
snort ET TROJAN Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M3 rev 1 2024-03-28
suricata ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 rev 1 2024-03-28
suricata ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M3 rev 1 2024-03-28
snort ET TROJAN Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M2 rev 1 2024-03-28
suricata ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M2 rev 1 2024-03-28
suricata ET MALWARE Win32/Vidar Variant/Mars Stealer Resources Download rev 2 2024-03-26
suricata ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1 rev 2 2024-03-14
suricata ET MALWARE Vidar/Arkei/Megumin Stealer Keywords Retrieved rev 3 2024-03-08
snort ET TROJAN Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1 rev 1 2023-11-10
snort ET TROJAN Win32/Vidar Variant/Mars Stealer Resources Download rev 2 2023-04-04
snort ET TROJAN Arkei/Vidar/Mars Stealer Variant Data Exfiltration Attempt rev 1 2022-08-15
snort ET TROJAN Arkei/Vidar/Mars Stealer Variant rev 2 2022-04-21
snort ET TROJAN Win32/Vidar Variant/Mars Stealer CnC Exfil rev 1 2021-06-23
suricata ET MALWARE Vidar Stealer - FaceIt Checkin Response rev 1 2021-06-02
snort ET TROJAN Vidar Stealer - FaceIt Checkin Response rev 1 2021-06-02
suricata ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern rev 5 2020-08-28
suricata ET MALWARE Vidar/Arkei Stealer Client Data Upload rev 5 2020-08-27
snort ET TROJAN Vidar/Arkei/Megumin/Oski Stealer Data Exfil rev 2 2020-01-08
snort ET TROJAN Vidar/Arkei/Megumin Stealer Keywords Retrieved rev 2 2019-07-11
snort ET TROJAN Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern rev 3 2019-04-30
snort ET TROJAN Vidar/Arkei Stealer Client Data Upload rev 5 2019-02-21