Vidar stealer adds virtual machine and custom stream ciphers to hide strings

Zscaler’s ThreatLabz has detailed how the Vidar information stealer has evolved its string obfuscation between May and early September 2026, moving from single-byte XOR to ChaCha20 and then to a custom virtual machine executed by a lightweight bytecode interpreter.

From internal version 2.0, Vidar combines that VM with a custom stream cipher whose opcodes, constants and substitution tables change with every build. The VM decrypts strings directly or recovers the key and nonce for the stream cipher, which uses either a modified ChaCha construction or an ARX design seeded with FNV-1a and golden-ratio constants.

ThreatLabz said the per-build randomisation is intended to defeat static and automated analysis, and published indicators of compromise for Vidar versions 2.0, 2.5, 3.1 and 3.4.