Vidar, a notorious information-stealing malware, has evolved with new string obfuscation techniques to hinder cybersecurity researchers and automated analysis tools This article explores vidar string obfuscation. . Zscaler ThreatLabz monitored Vidar samples from May 2026 to early September, discovering that the malware transitioned from basic XOR string encryption to modified ChaCha20 routines and finally to a custom virtual machine combined with a changing stream cipher.

These updates make each build of Vidar appear distinct at the code level, even when it performs identical functions. This approach can diminish the effectiveness of static signatures, which frequently rely on predictable strings, constants, or byte patterns to identify malware. Vidar is commonly employed to gather browser data, cryptocurrency wallet information, stored credentials, and other victim-system details.

The latest protection layers of the malware are designed to conceal operational strings, including error messages, browser collection details, and HTTP headers, until runtime. Vidar’s string obfuscation evolved from early May to early September 2026, with 14 valid handlers and unused entries stopping execution. Earlier versions utilized a modified ChaCha design with a custom 128-bit state, an eight-byte key, a four-byte nonce, and altered quarter-round rotation values, as reported by Zscaler.