Back Scworld

Vidar infostealer evolves, uses image files for stealthy attacks | brief

Scworld • April 28, 2026

Per HackRead, hackers are embedding malicious code within everyday files like JPEG images and text documents to deploy a new version of the Vidar infostealer. The malware has transformed from a simple password stealer into an adaptable attack framework utilizing a multi-stage infection chain.

The latest Vidar campaign leverages social engineering, exploiting a recent Claude Code leak by setting up fake GitHub repositories. Developers are lured into downloading trojanized versions of the tool. Attackers also use , Discord, and compromised WordPress sites to trick users into running malicious commands disguised as game cheats or CAPTCHA verifications.

The infection chain begins with VBScript and PowerShell, leading to a Go-compiled loader. The malware uses steganography to hide Base64-encoded data within seemingly normal JPEG and TXT files, reconstructing the Vidar payload in memory. It employs living-off-the-land techniques, abusing Windows binaries like WScript and PowerShell for stealth. This fileless approach evades most security scanners.

The infostealer targets credentials, crypto wallets, and session data from over 200 browser extensions, exfiltrating the stolen information via Telegram and Cloudflare-fronted domains to conceal attacker activity.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Vidar Infostealer Adopts Fileless Techniques Using JPEG and TXT Payloads The Vidar infostealer has evolved into a sophisticated multi-stage attack framework that utilizes fileless techniques to evade detection. Attackers embed malicious payloads within JPEG images and TXT documents, leveraging social engineering tactics such as fake GitHub repositories and compromised WordPress sites to lure victims. Initial access is gained through VBScript and PowerShell, with the malware employing living-off-the-land binaries like WScript and RegAsm.exe for execution. The campaign targets sensitive information, including credentials and cryptocurrency wallets, exfiltrating data via Telegram and Cloudflare-fronted domains. Researchers have documented the infection chain, highlighting the use of steganography and in-memory execution to avoid traditional security measures. Security professionals are advised to monitor for suspicious activity related to these file types and to implement behavior-based detection strategies. The scope of impact includes users of over 200 browser extensions, making it a significant threat to personal and organizational security. 9 sources 71

Extracted Entities

Vidar infostealer evolves, uses image files for stealthy attacks | brief

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (5)

Platforms (1)

Tools (3)