L’Acronis Threat Research Unit (TRU) ha detected hundreds of GitHub repositories distributing Vidar Stealer 2.0 malware masquerading as video game cheats
Acronis, global leader in the protection informatica has identified hundreds of GitHub repositories spreading malware online under the guise of “free cheats,” and while the abuse of GitHub as a platform for infostealers is not new, it remains particularly effective.
In particular, Acronis TRU detected several campaigns of Vidar 2.0, a new version of the popular Vidar infostealer malware family. Recent postal police operations against Lumma and Rhadamanthys have compromised much of their infrastructure. In the meantime, however, Vidar 2.0 — completely rewritten in C from C++, with improved speed and stability, automatic morphing, new browser hijacking capabilities, multithreaded execution, and more robust anti-parsing — has gained ground. This infostealer avoids C2 servers coded using Telegram bots and Steam profiles and targets browser extensions, crypto wallets, FTP/SSH credentials, local files, social apps and screenshots. Its lower cost than Lumma, an established reputation, and expanded features make it attractive.
Fake GitHub repositories distribute Vidar 2.0
In this campaign, the victim is tricked into downloading software named “TempSpoofer.exe”, “Monotone.exe” or “CFXBypass.exe”. The fake application downloaded from the GitHub repositories represents the first-stage payload. Analysis revealed that these executables are PowerShell scripts compiled into .NET binaries via the open-source PS2EXE module. Compiled PowerShell payloads can bypass basic script-based detections and make execution easier for non-technical users through normal interaction with an executable file. The PowerShell loader performs several malicious operations, adds Windows Defender exclusion for a directory controlled by the hacker, disabling scanning of subsequent payloads deposited in this directory.
It then contacts a hard-coded Pastebin URL to retrieve a second URL, this time hosted on GitHub. This behavior is consistent with Vidar's TTPs, which leverage legitimate services to dynamically host and recover malicious infrastructure. It then creates a randomly named directory within the %AppData% directory, adds it to Defender's exclusion list, and downloads a second executable called “background.exe”. Before execution, it verifies the file by checking the MZ header and sets the directory and file attributes to “hidden” so that they are not visible to the user.
The downloaded payload (background.exe) is a version of Vidar Stealer 2.0 protected with Themida and attempts to elevate its privileges via “runas”. Persistence is then established via a scheduled task called “SystemBackgroundUpdate”, configured to run when the elevated user logs in. Once Vidar runs, it creates a directory within %ProgramData% where it stores all stolen data, then exfiltrates it to command and control (C2) servers. Vidar is known to use Telegram and Steam as “dead drop resolvers” (DDR) to cloak their C2 servers.
Reddit posts promoting cheats for CS2
At the same time, another variant of the campaign was discovered that spreads Vidar 2.0 via posts on Reddit advertising cheats for the CS2 game. The posts redirect users to a website from which the malware is downloaded. The downloaded archive, “EzFrags_Private.zip”, contains several files, including a large executable that serves as the initial loader. Inspection of the file's metadata shows that it is a self-extracting archive (SFX), which extracts an embedded file cabinet, and also has an invalid digital signature, raising suspicions about its legitimacy. Once executed, the loader extracts an embedded cabinet archive and executes a command to process one of its components. The script uses variable names and randomized text to complicate static analysis. After extracting the relevant lines, the script works as a dropper of the final payload.
Mitigation and recommendations from Acronis
The new campaigns highlight how trusted platforms can be exploited to spread malware. Trust in social media and popular download channels allows hackers to bypass many defenses. Acronis recommends implementing modern endpoint/EDR solutions with signature-based and behavioral analytics; keep operating systems and applications updated; apply policies that prevent execution from directories not typically used by legitimate software; and educate users about the risks of unofficial downloads, recommending the use of verified sources.
