Vidar Stealer 2.0 Spread Through Fake Game Cheats on GitHub and Reddit

Mar 17, 2026 · Original article ↗

Summary

Acronis TRU analyzed campaigns using fake game cheats to deliver Vidar Stealer 2.0. The investigation details the infection chains, evasion and persistence methods, data targeted, and Telegram- and Steam-based C2 discovery.

Key points

Acronis TRU identified hundreds of GitHub pages and repositories distributing infostealers as free game cheats, and said the total may reach thousands.
Campaigns lure users through fake cheat pages promoted on platforms including Reddit and Discord; observed delivery chains use PowerShell loaders, Pastebin, GitHub-hosted payloads, and a Themida-packed Vidar payload.
One analyzed loader adds Microsoft Defender exclusions, hides and runs the payload, and creates a scheduled task for persistence.
The researchers found Vidar 2.0 uses polymorphic builds, multithreading, control-flow obfuscation, and debugger and virtual-machine checks.
Vidar targets browser credentials and cookies, Azure tokens, cryptocurrency wallet data, messaging-app artifacts, FTP/SSH credentials, local files, and screenshots.
The analyzed samples used Telegram bots and Steam profiles to conceal C2 addresses; Acronis also provided a YARA rule and recommended EDR, restricting execution from unusual directories, and avoiding unofficial downloads.

Article Details

Attack Vectors: Fake game-cheat repositories and landing pages on GitHub Pages, promoted through Discord and Reddit, lure users into downloading and running infostealers.
In one delivery chain, a PowerShell loader compiled with PS2EXE retrieves a secondary GitHub-hosted payload URL from Pastebin, downloads background.exe, hides it, and adds its directory to Microsoft Defender exclusions.
The downloaded Vidar payload is executed in the background and attempts privilege elevation with runas; persistence is then established with a scheduled task named SystemBackgroundUpdate.
A Reddit-promoted cheat variant delivers a ZIP containing a self-extracting loader, embedded cabinet files, a VBS dropper, and an AutoIt interpreter used to execute the Vidar payload.
Vidar uses Telegram and Steam profiles as dead-drop resolvers to conceal C2 addresses, and steals browser credentials, tokens, wallet data, messaging-app artifacts, files, and screenshots.
Defensive Notes: Deploy endpoint protection or EDR with behavioral and signature-based scanning to monitor suspicious process chains, credential access, and data exfiltration.
Keep applications and operating systems updated so security patches are applied.
Restrict execution from directories not typically used by legitimate software and apply least-privilege controls.
Educate users to avoid unofficial downloads and obtain software only from verified vendors or trusted repositories.

Indicators of compromise

Type	Indicator	Context
SHA256	`2f416aac027f19f563cc45e3b4b72e992aaafb63da27f968b9a76a391134dc7d`	Compiled PowerShell loader hash listed as an IOC for the Vidar distribution campaign.
SHA256	`496d15810c25136955dd9aed6d018519380ee431f28c1bca715da59fe1385d12`	Hash identified in the IOC table as a C2 server artifact.
SHA256	`4a090e26e285661730dfd0911856c830bd0a44e639237178476ccb4993d7974f`	Hash of an inflated Vidar loader identified in the IOC table.
SHA256	`b1cebd305c6aa27048a3673e70f8e1604735b2c06c83452d2935c330b5a3eb58`	File hash listed in the article's IOC table for the Vidar distribution campaign.
SHA256	`b6192c05029c8905fcbb88469d712dfdeaf1feb33b0690f8539373f19b6cbf85`	File hash listed in the article's IOC table for the Vidar distribution campaign.
SHA256	`bfee57d9e1b68c5c5aa63792b4e67b94f3361749e186531bd01609d9382672f3`	File hash listed in the article's IOC table for the Vidar distribution campaign.
SHA256	`c5e7fab18baee4a6b092e566414f4d2df1afbde35a1d12f518113054f144853f`	File hash listed for a ZIP containing an inflated Vidar payload.
SHA256	`cbf2218ce316134795c75691f17dfaf02071ff5c369049fbf11ed072cf2103ab`	File hash listed in the article's IOC table for the Vidar distribution campaign.
SHA256	`d1258b4c2b9849833651d1e844d1a99a5bc7febbb751548f960e92525afe6c26`	Hash identified in the IOC table for Vidar Stealer 2.0.
SHA256	`d1721c9adcfa3d16bb4907afccfae64517e6c58a7c6ef058c9f5f543f60240c9`	File hash listed in the article's IOC table for the Vidar distribution campaign.
SHA256	`e1979c42cb9e72ba9f9fcae7364887df1edcad38128feefdc3adbc768c51da05`	Hash of an extracted Vidar loader identified in the IOC table.
SHA256	`fa7eafa65996c325faf2d77cc2d80179daa9228b3c138d2d3365280c79e30820`	File hash listed in the article's IOC table for the Vidar distribution campaign.
URL	`hxxps[:]//steamcommunity[.]com/profiles/76561198761022496`	Steam profile URL listed as a Vidar C2-related indicator.
URL	`hxxps[:]//steamcommunity[.]com/profiles/76561198765046918`	Steam profile used by the analyzed Vidar sample as a dead-drop resolver to obtain its C2 address.
URL	`hxxps[:]//steamcommunity[.]com/profiles/76561198780411257`	Steam profile URL listed as a Vidar C2-related indicator.
URL	`hxxps[:]//telegram[.]me/ahnadar`	Telegram C2-related URL listed among the campaign's indicators of compromise.
URL	`hxxps[:]//telegram[.]me/bul33bt`	Telegram dead-drop resolver URL contacted by the analyzed Vidar sample to conceal its C2 infrastructure.
URL	`hxxps[:]//telegram[.]me/cego54`	Telegram C2-related URL listed among the campaign's indicators of compromise.