Vidar Stealer 2.0 Spreads via Fake Game Cheats Shared on GitHub and Reddit

Large‑scale campaigns abusing GitHub and Reddit to spread Vidar Stealer 2.0 through fake “free game cheats,” targeting players of popular online titles across the board.

The operation shows how the takedown of other infostealers has shifted criminal demand toward Vidar, while gaming communities remain a lucrative and under‑reported target.

Attackers hide download links behind images and redirect victims through third‑party sites, making automated detection and takedown difficult.

Campaigns often start with posts on cheat‑focused subreddits or Discord communities, promising powerful free cheats for titles like CS2 and other competitive games.

TRU analysts identified hundreds of GitHub repositories masquerading as cheat or hardware‑ID unban tools, with the true number of malicious projects likely in the thousands.

From there, users are funneled to GitHub Pages or look‑alike landing sites that imitate legitimate installers and walk them through disabling security tools and running password‑protected archives.

Targeting Gamers’ Digital Assets

Gamers looking for free cheats are a near‑perfect victim pool: they deliberately bypass official channels, expect security warnings, and are unlikely to report compromise.

Once Vidar 2.0 executes, it harvests browser credentials, cookies, autofill data, Azure tokens, cryptocurrency wallets, FTP/SSH passwords, Telegram and Discord data, Steam artifacts and local files before exfiltrating them to attacker‑controlled infrastructure.

Compromised gaming accounts can carry real‑world value via rare items, badges, high‑level characters and in‑game currency that can be laundered through grey markets with minimal oversight.

The “free cheat” lure also disproportionately affects minors and young adults who may lack security awareness and be less willing to seek help after an incident.

In one GitHub‑based variant, victims download fake tools such as “TempSpoofer.exe,” “Monotone.exe” or “CFXBypass.exe,” which are actually PowerShell loaders compiled as .NET binaries using PS2EXE.

Themida‑packed Vidar 2.0 sample that stores stolen data under ProgramData and uses Telegram bots and Steam profiles as dead drop resolvers to hide its command‑and‑control (C2) addresses.

The loader adds a Microsoft Defender exclusion, retrieves a second‑stage URL from Pastebin, drops a hidden “background.exe” into AppData and executes it with elevated privileges via the Windows runas utility before establishing persistence using a scheduled task named “SystemBackgroundUpdate.”

A separate Reddit‑driven CS2 cheat campaign delivers a bloated self‑extracting archive (“EzFrags_Private.zip”) containing junk‑padded loaders, VBS scripts hidden in .mdb files and an AutoIt interpreter that ultimately assembles and runs the Vidar 2.0 payload from split fragments.

Vidar 2.0: A Stealthier Infostealer

Vidar 2.0 represents a significant evolution of the long‑running Vidar family, with a full rewrite from C++ to C, multithreaded execution and an “automatic morpher” that alters code structure between builds to evade static signatures.

Once the Vidar stealer executes, it creates a directory within the %ProgramData% where it will store all the stolen data and exfiltrates them in their command-and-control (C2) servers. 

It employs pervasive control‑flow obfuscation, debugger and VM checks, timing‑based anti‑analysis and resource‑based heuristics to detect sandboxes, then runs tailored multithreading modes depending on system capabilities.

For data theft, Vidar 2.0 includes custom browser decryption logic and C2‑triggered browser injection, extensive file‑grabbing across user directories, focused targeting of Azure CLI caches, Monero wallets, browser crypto‑extension storage, Telegram/Discord artifacts, FTP/SSH clients and screenshots captured via GDI APIs.

Upon inspection, file metadata shows that the binary is a self-extracting archive (SFX) that extracts the embedded cabinet file and it also has an invalid digital signature which adds more suspicion regarding its legitimacy.

These capabilities, combined with dead‑drop C2 hiding on Telegram and Steam, allow Vidar campaigns to complete exfiltration quickly and quietly, often before victims notice anything is wrong or can revoke stolen tokens.

Law‑enforcement operations that disrupted Lumma and later Rhadamanthys have reshaped, rather than reduced, the infostealer ecosystem.

As these services faltered, Vidar’s relatively low cost, long‑standing reputation and aggressive feature roadmap made it an attractive replacement for criminals, driving a visible increase in Vidar‑based campaigns distributed via social media, gaming platforms and pirated software.

The ongoing Vidar 2.0 cheat campaigns highlight a broader risk: any ecosystem that normalizes sideloaded, untrusted tools especially among young users is likely to be systematically weaponized by threat actors.

Security teams should treat gaming‑related traffic and unapproved executable downloads as high‑risk, pairing strict application‑control policies with user education that explicitly addresses “free cheats” as a malware vector.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.