TF-1868533 high

Description

Indicator that identifies a botnet command&control server (C&C). IOC type: URL that is used for botnet Command&control (C&C). Attributed malware: Vidar. Confidence: 100. First seen: 2026-08-04 21:45:05 UTC. Last seen: 2026-08-04 23:25:51 UTC. Reporter: crep1x. Tags: Vidar.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (2)

• Malpedia profile ThreatFox IOCs
• ThreatFox IOC page ThreatFox IOCs

  Indicator that identifies a botnet command&control server (C&C). IOC type: URL that is used for botnet Command&control (C&C). Attributed malware: Vidar. Confidence: 100. First seen: 2026-08-04 21:45:05 UTC. Last seen: 2026-08-04 23:25:51 UTC. Reporter: crep1x. Tags: Vidar.

• Vidar Trojan Analysis, Malware Overview by ANY.RUN
  web:any.run

  Vidar is an information stealer trojan. It is either a fork of Vidar or the result of its evolution. Follow live malware statistics of this trojan and get new reports, samples, IOCs, etc.

  2026-08-05 06:29 UTC
• Vidar Infostealer Being Spread through Phishing Emails - ASEC
  web:asec.ahnlab.com

  Vidar is being distributed through phishing emails that use keywords such as "job recruitment" and "copyright infringement." Since it is disguised as a document file, users may download and execute the Attachment thinking it is a legitimate document; when this happens, sensitive information—such as credentials and user files stored on ...

  2026-08-05 06:29 UTC
• The Evolving Tactics of Vidar Stealer: From Phishing Emails to Social Media
  web:thehackernews.com

  Vidar stealer now uses throwaway accounts on social media platforms to retrieve the address of its command-and-control servers and steal information.

  2026-08-05 06:29 UTC
• What is Vidar Malware? - Check Point Software
  web:www.checkpoint.com

  Vidar is an infostealer malware that can also be used to deliver additional forms of malware. Some of the ways that an organization can protect against this malware threat include the following: Employee Training: Vidar is commonly distributed via phishing emails or fake downloads of legitimate software, which actually deliver the malware.

  2026-08-05 06:29 UTC
• Vidar Network: Analyzing a Prolific Info Stealer - Darktrace
  web:www.darktrace.com

  In the latter half of 2022, Darktrace observed a rise in Vidar Stealer infections across its client base. These infections consisted in a predictable series of network behaviors, including usage of certain social media platforms for the retrieval of Command and Control (C2) information and usage of certain URI patterns in C2 communications.

  2026-08-05 06:29 UTC
• PDF 202407021700_Vidar Malware Analyst Note_TLPCLEAR - HHS.gov
  web:www.hhs.gov

  Vidar frequently uses social media as part of its command and control (C2) infrastructure. The IP address of the C2 infrastructure will be embedded in a user profile on platforms like Mastodon, Telegram, etc. The malware can access this profile, contact the indicated IP address, and download configuration files, instructions, and other malware.

  2026-08-05 06:29 UTC
• Vidar Malware: Analysis, Detection, Removal | Huntress
  web:www.huntress.com

  Vidar malware is an information-stealing trojan that targets sensitive data, such as login credentials and cryptocurrency wallets. It works by deploying a payload to infected systems, collecting data, and transmitting it to command and control servers controlled by attackers.

  2026-08-05 06:29 UTC
• PDF : Vidar - intrinsec.com
  web:www.intrinsec.com

  The state of Vidar in the beginning of 2026. Following major takedowns affecting Lumma and Rhadamanthys, Vidar profited from the generated chaos to rise to the top of the stealer ecosystem. We assess that this rise was made available due to the release of version 2.0 of the malware, and to the collaboration with "Cloud" Telegram channels.

  2026-08-05 06:29 UTC
• Hacked sites deliver Vidar infostealer to Windows users
  web:www.malwarebytes.com

  We found fake "verify you are human" pages on hacked WordPress sites that trick Windows users into installing the Vidar infostealer.

  2026-08-05 06:29 UTC
• Inside Vidar (2026): From Infection to Memory Execution via JPEG and ...
  web:www.pointwild.com

  Initial Infection Vector for Vidar (2026) The initial infection vector for Vidar infostealer in 2026 has significantly evolved from traditional exploit-based delivery to highly user-driven and social engineering-based execution chains.

  2026-08-05 06:29 UTC

Only Available for Registered Users. Sign in to view.