Fake YouTube Software Downloads Used to Deliver Vidar Infostealer in New Credential Theft Campaign

A new wave of Vidar infostealer campaigns is targeting employees through fake software downloads promoted in YouTube videos. What appears to be a normal installation process for productivity or utility tools is actually a delivery mechanism for credential theft malware.

Security researchers observed attackers using convincing software lures, file-sharing platforms, and trusted-looking executables to compromise endpoints and extract sensitive browser data, account credentials, and wallet information.

The campaign reflects a broader trend where infostealers are replacing ransomware as the preferred initial access vector for financially motivated threat actors.

How the attack works

The infection chain is designed to look routine and trustworthy.

At a high level:

• A victim searches YouTube for software tools or tutorials
• A video promotes a “useful” application and includes a download link
• The user is redirected through a file-sharing platform such as MediaFire
• A ZIP archive is downloaded containing a fake installer
• The visible executable launches a hidden malicious DLL
• The DLL deploys the Vidar payload silently in the background

In the observed campaign, the fake software package used the name NeoHub, while the malicious payload was hidden inside a file named msedge_elf.dll, designed to resemble a legitimate Microsoft Edge component.

This DLL was also signed using fake code-signing certificates to reduce suspicion and improve execution success.

What Vidar steals

Vidar focuses on harvesting valuable access data from browsers and local applications.

Common targets include:

• saved browser passwords
• cookies and active sessions
• autofill data and stored payment information
• cryptocurrency wallets
• authentication tokens
• enterprise credentials linked to SaaS platforms

Affected browsers include Chrome, Edge, Firefox, Opera, Vivaldi, Waterfox, and others.

Stolen logs are commonly resold on underground marketplaces, allowing secondary attackers to use them for account takeover, fraud, business email compromise, or deeper network intrusion.

Why this matters

The real danger is not the malware itself, but what happens after credential theft.

One compromised employee browser can expose:

• VPN access
• Microsoft 365 sessions
• CRM platforms
• cloud dashboards
• privileged internal systems

This makes infostealers highly effective for follow-on attacks, especially in organizations where browser sessions are heavily tied to daily operations.

Vidar has also been associated with broader criminal ecosystems and has been referenced in investigations involving groups such as Scattered Spider.

DIAMATIX Perspective

Credential theft is increasingly becoming the first stage of enterprise compromise.

The attacker no longer needs to break in through a vulnerability. Often, they simply wait for a user to install what looks like legitimate software.

This changes the security model:

• prevention alone is not enough
• endpoint visibility becomes critical
• identity monitoring becomes central to defense

At DIAMATIX, we see infostealers as an operational security problem, not just a malware problem.

Detection must include:

• unusual outbound traffic
• suspicious browser session activity
• abnormal authentication behavior
• impossible travel and session anomalies

The faster credential misuse is identified, the smaller the blast radius.

CISO Analysis

From a CISO perspective, this is a supply-chain style social engineering attack disguised as normal user behavior.

Priority actions include:

• restricting software downloads from unmanaged sources
• enforcing MFA across all browser-linked business systems
• monitoring credential exposure in threat intelligence feeds
• session management and forced reauthentication policies
• DNS filtering and secure web gateways

The question is no longer whether users will click. It is how quickly the organization can detect and contain the impact.

Sources

• Intrinsec – Vidar malware campaign analysis
• CISA – advisory referencing infostealer usage and Scattered Spider activity
• Public threat intelligence reports on Vidar MaaS operations

This article is based on publicly available threat intelligence and technical disclosures as of April 2026.