Vidar
A long-running stealer, often delivered together with other malware. What it takes from an infected computer, how it gets there, and how to check whether your logins ended up in its logs.
- Also called
- Vidar stealer
- Seen since
- 2018
- Runs on
- Windows
- Sold as
- Malware-as-a-service, built on the older Arkei stealer
What Vidar takes
- Browser passwords, cookies, history and autofill entries
- Cryptocurrency wallets
- Files from the desktop and documents folders
- A screenshot and details of the computer
How it spreads
- Bundled with other malware by loaders
- Fake software downloads and malicious ads
- Phishing attachments
Background
Vidar is one of the oldest stealers still in use and has been updated many times. It is known for finding its control servers through profile pages on ordinary public websites, which makes it harder to block.
Checking for your logins
Search your email address, username or company domain on this site. The check covers stealer logs from every family, Vidar included, and shows how many of your logins are in them, for which sites and where the devices were.
A stealer log doesn’t record which malware made it, so a result won’t say whether it was Vidar or another stealer. The steps afterwards are the same either way: clean the device, then change passwords from a safe one.
Other infostealers
- RedLine Stealer: For years the most common source of stealer logs on the market.
- Lumma Stealer: The stealer behind the fake “verify you are human” pages.
- Raccoon Stealer: A low-cost stealer whose alleged operator was arrested in 2022.
- StealC: A newer stealer that borrows from Vidar, Raccoon and RedLine.
- Atomic macOS Stealer: Proof that Macs get infostealers too.
The full records are on Seer
This site shows how many stealer log records hold a login and a masked sample of them. Seer, which runs the check, shows every record in full: the saved logins and passwords, the cookies, the infected device and when the log was collected.
Seer also searches breach records and social accounts, so one email address shows everywhere it has leaked and every account it is linked to.
- Stealer log searchFull records from infected devices, by email, username, domain, password or IP address.
- Breached credentialsWhich data breaches an email address or username appears in, and what leaked with it.
- Social account searchThe accounts an email address, username or phone number is linked to across hundreds of sites.
- Plans and pricingA free account to start, and plans for investigators and security teams.