Vidar Stealer 2.0 distributed via fake game cheats on GitHub and Reddit

MITRE Techniques

• [T1204.002 ] User Execution: Malicious Link – Social‑engineering lures on Discord/Reddit and fake cheat pages entice users to download and run payloads (‘offer for a “free” cheating tool.’)
• [T1059.001 ] PowerShell – Initial loader uses PowerShell scripts compiled into .NET binaries via PS2EXE to execute the infection chain (‘executables are PowerShell scripts compiled into .NET binaries using the open-source PS2EXE module.’)
• [T1105 ] Ingress Tool Transfer – Secondary payloads and final binaries are retrieved from Pastebin and GitHub-hosted URLs (‘contacts a hard-coded Pastebin URL to retrieve a secondary GitHub-hosted payload URL.’)
• [T1053.005 ] Scheduled Task/Job – Persistence is created via a scheduled task that runs the payload at user logon (‘persistence is established through a scheduled task named “SystemBackgroundUpdate”‘)
• [T1562.001 ] Impair Defenses: Disable or Modify Tools – The loader adds Microsoft Defender exclusions for attacker-controlled directories to evade scanning (‘adds a Windows Defender exclusion for a specified attacker-controlled directory.’)
• [T1027 ] Obfuscated Files or Information – Vidar uses control‑flow flattening, junk padding and a polymorphic builder to evade static detection (‘control-flow obfuscation in every function… automatic morpher making each build different’)
• [T1055 ] Process Injection – Reflective DLL loading and remote-thread creation are used to inject code into browser processes for credential extraction (‘performs injection using Reflective DLL loading… load the image as a library… create a remote thread.’)
• [T1113 ] Screen Capture – GDI-based screen capture is used to take screenshots and save them locally for exfiltration (‘uses a GDI screen-capture technique… Screenshot will be saved as a “screenshot.jpg” file.’)
• [T1102 ] Web Service – Command-and-control and dead-drop resolvers abuse Telegram bots and Steam profiles to mask true C2 infrastructure (‘Vidar is known to abuse Telegram and Steam as dead drop resolver (DDR) to mask their C2 servers.’)
• [T1041 ] Exfiltration Over C2 Channel – Stolen data and logs are exfiltrated to remote C2 servers via the established channels (‘exfiltrates them in their command-and-control (C2) servers.’)
• [T1083 ] File and Directory Discovery – A recursive file grabber searches user folders and removable drives for target data and files (‘implements a directory-based file search routine that recursively searches for files from given folders.’)
• [T1555 ] Credentials from Password Stores – The stealer targets browser password stores, key4.db and other local credential stores to harvest saved logins and tokens (‘extracting browser credentials, cookies and autofill data… key4.db’)
• [T1497 ] Virtualization/Sandbox Evasion – Anti-analysis checks include debugger detection, timing checks and memory-based VM detection to avoid sandbox environments (‘advanced obfuscation, debugger detection, timing checks and VM detection hinder analysis.’)