As cited
Copy frozen at (site build).
threat intel
Vidar Adds Virtual Machine and Custom Stream Ciphers For String Obfuscation
Vidar, an information stealer first observed in 2018, has evolved its string obfuscation techniques from basic XOR encryption to a custom virtual machine combined with per-build stream ciphers as of September 2026. The malware now uses a lightweight bytecode interpreter with 14 variable opcodes and custom stream ciphers based on either ChaCha or add-rotate-XOR (ARX) primitives, with constants and substitution tables that differ across each build. These techniques are designed to evade static analysis and automated detection by introducing variation that prevents signature-based identification.
Why it matters: Defenders monitoring for Vidar infections must account for build-specific obfuscation; static signatures and decryption tools will not generalize across samples, requiring behavioral and network detection approaches instead.
- Source published
- First seen by Cybersecurity Tracker