en
VidarStealerVidar (also known as VidarStealer) is an information-stealing malware family. Vidar targets browser credentials, cryptocurrency wallets, Telegram/Discord session tokens, FTP, email, and VPN client configurations and Documents and screenshots from the desktop. As of 11/10/2026, CyStack's research records 11 variants distributed through 2 channels, with high attribution confidence.
Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes
Original English
Vidar Stealer logs. Build 4.x emits a flat key-colon-value
information.txt opening with Ip:, Country:, Version:
followed by hardware, locale, and build identity blocks. Vidar
has been distributed since 2018 as a fork of Arkei and remains a
high-volume infostealer family in 2025+.
2 distinct distribution channels recorded for this malware
| Panel name | Distribution channel | Confidence |
|---|---|---|
| — |
Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.
| Telegram |
| High |
| ru******** | Website | High |
The data in this table is for reference only and is compiled by CyStack researchers. To investigate and scope an incident in detail, organizations should use dedicated solutions such as CyStack Threat Intelligence
11 variants recorded for this malware
| ID | Data collected | Confidence |
|---|---|---|
00dd954... | 4,414,515 | High |
291eb86... | 1 | High |
3d30d56... | 1,596 | High |
4b60006... | 1 | High |
5825071... | 2,128 | High |
To see more variants, organizations should use dedicated solutions such as CyStack Threat Intelligence
Ip: <value>Country: <value> Date: <value>MachineID: <value>GUID: <value>HWID: <value> Path: <value>Work Dir: <value> Windows: <value>Install Date: <value>AV: <value>Computer Name: <value>User Name: <value>Display Resolution: <value>Keyboard Languages: <value>Local Time: <value>TimeZone: <value> Processor: <value>Cores: <value>Threads: <value>RAM: <value>VideoCard: <value> Kingdom: <value>
