Reported by 4 outlets

Timeline

1. original reporting

   Vidar Adds Virtual Machine and Custom Stream Ciphers For String Obfuscation

   malware.news · 22d ago · September 21st, 2026

   IntroductionVidar is an information stealer that was first observed in 2018. Across its iterations, Vidar has continued to improve its string obfuscation to make detection and analysis more difficult by changing deobfuscation algorithms, constants, and primitives. From May through early September 2026, Zscaler ThreatLabz tracked Vidar’s string obfuscation as it evolved from basic XOR to ChaCha20, and more recently, to a custom virtual machine (VM), which is executed via a lightweight bytecode interpreter that is combined with a custom stream cipher that changes with each build.In this blog post, ThreatLabz covers Vidar’s string obfuscation methods from version 2.0 to the latest version 3.3. Key TakeawaysVidar is an information stealer that was first observed in 2018 that initially obfuscated strings with XOR-based encryption.The Vidar developer later migrated to more advanced string encryption algorithms based on ChaCha20.In June 2026, ThreatLabz observed Vidar introduce a virtual machine to protect the malware’s strings with different opcodes that change per build. In addition to the virtual machine, a new custom stream cipher algorithm was added with operations that vary across builds. These per-build string obfuscation techniques are designed to hinder static and automated analysis. Evolution TimelineEarlier versions of Vidar used single-byte XOR operations to obfuscate strings. Beginning with internal version 1.5, the developer adopted ChaCha20. Starting in versions 1.8,

2. update from www.zscaler.com

   New. Zscaler: Vidar Adds Virtual Machine and Custom Stream Ciphers For String Obfuscation https://www. zscaler.com/blogs/security-res earch/

   www.zscaler.com · 22d ago · September 21st, 2026

   Zscaler: Vidar Adds Virtual Machine and Custom Stream Ciphers For String Obfuscation https://www. zscaler.com/blogs/security-res earch/

   via Mastodon https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation

3. update from gbhackers.com

   Vidar Uses Custom Bytecode Interpreter and ARX Stream Ciphers for Per-Build String Obfuscation

   gbhackers.com · 21d ago · September 22nd, 2026

   First observed in 2018, Vidar remains a widely tracked credential-stealing malware family. Its operators continually alter internal protections without necessarily changing the malware’s broader operational purpose: […] The post Vidar Uses Custom Bytecode Interpreter and ARX Stream Ciphers for Per-Build String Obfuscation appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

4. update from cyberpress.org

   Vidar Infostealer Uses Custom Virtual Machine and Stream Ciphers to Evade Malware Analysis

   cyberpress.org · 21d ago · September 22nd, 2026

   Vidar, a well-known information-stealing malware family first seen in 2018, has introduced new string-obfuscation methods designed to slow down security researchers and automated malware-analysis systems. The updates make each Vidar build look different at the code level, even when it performs the same functions. This approach can reduce the effectiveness of static signatures, which often rely on predictable strings, constants, or byte patterns to identify malware. Vidar is commonly used to collect browser data, cryptocurrency wallet information, stored credentials, plugins, and other victim-system data. The malware’s latest protection layers aim to hide operational strings such as error messages, browser collection details, and HTTP headers until runtime. The VM runs a bytecode interpreter that follows a fetch-decode-execute process. Each byte in the embedded bytecode acts as an opcode. The opcode selects a handler from a sparse 256-entry dispatch table. Evolution of Vidar’s string obfuscation from early May to early September 2026 (Source: zscaler) Only 14 entries contain val