Malware
Vidar
Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.
Indicators of Compromise 26
Domain gitcode[.]com Domain muckcoding[.]com Domain muckdeveloper[.]com Domain pastebin[.]com Domain rlim[.]com Domain t[.]me Filename 7zrr.exe Filename L.ps1 Filename Microsoft.exe Filename api.db Filename localStorage Filename sessionStorage GitHub Repo Camoufox GitHub Repo github.com/LastWer/MicrosoftCur GitHub Repo github.com/kaleidora/dnsub-scanning-tool GitHub Repo github.com/tb78/expresso SHA-256 129de16fe69763f767d8249279a2c4a1a6deafadd1a84563bd84b258ea010bff SHA-256 4ea1c577247b149489506b230e7aa203e1a2fa124109c6056d1986e944f520a4 SHA-256 51cada347262d7b2bcde70552fcdae221625ad75435cee8a9c3e7b67cc47a807 SHA-256 57e0449fb13766b0b2f7c057b1f89911e9ed23cac7e71d5d69fde47571239629 SHA-256 73c807df26427d6631088a822fa54c30975afbe681a9d83eff5d19e5b075d6c2 SHA-256 86819efe7319b664920ba2e1fd4b079a4e6b5eaaebeeb1adb2c1c8dc3c81ee0c SHA-256 969b0bfd605aa2cddf353f3638b0dee26b1c2305600231e055fa6d7786a879fe SHA-256 a628ad47fe93ee7413cca90aeca8f9540bfcd5ccdbeb4d9914670b3ef66247f4 SHA-256 e576a61e1a2ba71e764647bb2f0883c2f8fa4d591799c60d21a84230ee7a5b63 Registry User [email protected]
MITRE ATT&CK TTPs 37
T1012 T1027 T1027.013 T1036.005 T1053.005 T1055 T1057 T1059.001 T1071.001 T1078 T1082 T1090 T1102.001 T1105 T1112 T1113 T1133 T1140 T1195.001 T1203 T1204.002 T1212 T1484.001 T1490 T1542.001 T1543.003 T1548.002 T1552.001 T1555 T1555.003 T1558 T1564.003 T1566 T1574.002 T1588.001 T1608.001 T1685
Query Registry
Discovery
Obfuscated Files or Information
Defense Evasion
Encrypted/Encoded File
Defense Evasion
Match Legitimate Name or Location
Defense Evasion
Scheduled Task
Execution
Process Injection
Defense Evasion
Process Discovery
Discovery
PowerShell
Execution
Web Protocols
Command And Control
Valid Accounts
Defense Evasion
System Information Discovery
Discovery
Proxy
Command And Control
Dead Drop Resolver
Command And Control
Ingress Tool Transfer
Command And Control
Modify Registry
Defense Evasion
Screen Capture
Collection
External Remote Services
Persistence
Deobfuscate/Decode Files or Information
Defense Evasion
Compromise Software Dependencies and Development Tools
Initial Access
Exploitation for Client Execution
Execution
Malicious File
Execution
Exploitation for Credential Access
Credential Access
Group Policy Modification
Defense Evasion
Inhibit System Recovery
Impact
System Firmware
Persistence
Windows Service
Persistence
Bypass User Account Control
Privilege Escalation
Credentials In Files
Credential Access
Credentials from Password Stores
Credential Access
Credentials from Web Browsers
Credential Access
Steal or Forge Kerberos Tickets
Credential Access
Hidden Window
Defense Evasion
Phishing
Initial Access
DLL Side-Loading
Persistence
Malware
Resource Development
Upload Malware
Resource Development
T1685
Source Articles
Infostealer Logs Expose Replayable AI Tokens That Can Bypass MFA
Information stealer malware such as Lumma Stealer and Vidar are harvesting session tokens and API keys from compromised systems, enabling threat actors to replay these credentials and gain unauthorized access to AI services like Google Gemini, OpenAI, Anthropic, and others, bypassing multi-factor authentication. A 7 GB infostealer dump analyzed by Okta contained 44,791 unique JSON Web Tokens (JWTs), 555 of which were likely tied to AI service authentication, along with 2,937 encrypted JWE structures, primarily from OpenAI. Attackers are using stolen tokens to access premium AI models and sell access on underground forums, leveraging anti-detect browsers like Camoufox to avoid detection. The abuse of valid, unexpired API keys and tokens—termed 'LLMjacking'—allows attackers to conduct espionage, resource theft, or run up AI service bills on victims.
hacker-news ·2d ago
IT threat evolution in Q2 2026. Non-mobile statistics
In Q2 2026, multiple ransomware groups remained active, with Qilin emerging as the most prolific based on victims listed on data leak sites. Microsoft disrupted a malware-signing-as-a-service operation run by the threat actor Fox Tempest, which was used by several ransomware groups including Rhysida, Akira, and Qilin. CISA added a Windows local privilege escalation vulnerability (CVE-2026-33825, BlueHammer) to its KEV catalog due to active exploitation in ransomware attacks. Check Point attributed zero-day exploitation of a critical vulnerability in its Remote Access VPN (CVE-2026-50751) to the Qilin ransomware group. Additionally, the PayoutsKing group was observed using QEMU to deploy hidden Alpine Linux-based virtual machines as a stealthy backdoor technique.
securelist ·4w ago
Malicious Go Module Exposes GitHub Malware Lure Network Spanning 222 Repositories
A malicious Go module, github.com/kaleidora/dnsub-scanning-tool, serves as a lure to deliver a multi-stage Windows malware chain involving hidden PowerShell execution and encrypted payload resolution via public dead drops. The campaign, tracked as Operation Muck and Load, leverages a network of 222 GitHub repositories across 190 accounts to create credibility and scale for malicious or deceptive software projects. These repositories use synthetic activity to appear recently maintained, facilitating social engineering and malware distribution. The final payload includes RATs such as AsyncRAT, Quasar, and Remcos, along with infostealers like Vidar, enabling credential theft, screen capture, and persistence.
socket-dev