What is Vidar Stealer and Why Does It Target Gamers?
Vidar Stealer is a long-running information-stealing malware family, originally derived from the Arkei Stealer codebase in 2018, that extracts browser credentials, cryptocurrency wallets, session cookies, and saved passwords. Vidar 2.0, documented by Acronis Threat Research Unit in 2025, is distributed heavily via fake game cheats published on GitHub, Reddit, Discord, and YouTube. Gamers are targeted because their Steam, Discord, gaming-platform, and crypto-wallet accounts have high resale value on underground markets.
Vidar Stealer is one of the most persistent infostealer malware families targeting the gaming demographic. Where Lumma Stealer (subject of Microsoft's May 2025 takedown) was a newer entrant, Vidar has been an active threat since 2018, with multiple major version revisions, and remains in active distribution through 2025-2026. Acronis Threat Research Unit (Acronis TRU) published comprehensive documentation of Vidar 2.0's distribution patterns through 2025, with fake cheats as a primary infection vector.
What Vidar Stealer does
When Vidar infects a target machine, it performs comprehensive credential extraction in a single execution pass:
- Browser credentials — Chrome, Edge, Firefox, Brave, Opera, and forks; usernames, passwords, autofill data, browser history
- Session cookies — Discord, Steam, Twitch, gaming-platform authentication tokens, social-media session cookies
- Cryptocurrency wallets — Metamask, Phantom, Trust Wallet, Exodus, Electrum, hardware-wallet seed backups, transaction histories
- Saved passwords from password managers — KeePass database files, Bitwarden offline databases, LastPass offline data
- Two-factor recovery data — backup codes saved in browser, authenticator app exports
- Telegram session data — full session takeover allowing attacker to impersonate victim
- VPN credentials and configurations
- System fingerprint — hardware specs, installed software list, screenshot of desktop at time of execution
All extracted data is bundled into a zip archive and uploaded to operator-controlled command-and-control servers within 30-90 seconds of execution. The malware typically deletes itself after exfiltration.
Why gamers are targeted
Gamers possess a specific cluster of high-value credentials that infostealer monetization markets prize:
- Steam accounts — particularly those with high-value cosmetics, CS2 inventories, completed achievements, or rare items. Underground markets pay $20-2000+ per account depending on inventory value.
- Discord accounts — especially those with Nitro subscriptions or moderation positions in large servers. Stolen Discord accounts are used for further phishing campaigns.
- Gaming-platform credentials — Epic Games, Battle.net, Riot, Ubisoft Connect. Accounts with linked credit cards or PayPal are particularly valuable.
- Cryptocurrency holdings — gamers in tech-adjacent demographics often hold crypto. Wallet drainage is the fastest monetization path.
- Live-streamer credentials — Twitch, YouTube Gaming, content-creation platform access enables higher-value impersonation attacks.
The Acronis TRU report quantified the targeting: Vidar 2.0 campaigns observed across 2024-2025 directed roughly 60% of infection volume toward gaming-related lures.
Distribution via fake cheats
Vidar 2.0 distribution patterns documented by Acronis TRU:
- GitHub repositories — fake cheat projects with high-quality README files, multiple commits, and stars purchased from fake-engagement vendors. The actual executable downloads a Vidar payload.
- Reddit posts — claiming to share working cheats with download links to attacker-controlled hosting (Discord CDN, MediaFire, anonfiles, Mega.nz). Comments are heavily upvoted by botnets to manufacture trust.
- YouTube tutorial videos — "how to download X cheat 2025" videos with description links to malicious downloads. Comments are similarly bot-engaged.
- Discord servers — fake "cheat sharing" communities where new members are encouraged to download attacker-bundled installers
- Search-engine poisoning — Google search results for popular cheat queries pointing to attacker-controlled landing pages
The pattern is consistent across infostealer families: Lumma, Vidar, RedLine, Stealc, and Stealc-derived stealers all use approximately the same distribution playbook. Flare's 2024 research established 41.47% of gaming-related malware infections trace to fake cheats — a number that includes Vidar, Lumma, and the broader infostealer landscape.
How to recognize Vidar-distributed fake cheats
Common indicators (these are not exhaustive):
- The "cheat" is distributed as a single executable rather than a multi-component installer
- The download is gated behind a "complete a survey" or "watch an ad" step
- The hosting URL uses URL-shortener obfuscation
- The README claims undetectable status against a wide range of games (legitimate cheats are typically narrow per-game)
- The repository was created recently (under 30 days) but claims to be a long-running project
- The Discord server linked from the download requires invite codes and quickly bans questions about how the cheat works
Implications for buyers
Vidar Stealer 2.0 documentation reinforces what the Lumma takedown demonstrated: free cheat downloads in 2025-2026 carry a statistically-significant risk of being infostealer malware. Using a paid, vendor-vetted cheat from an established seller is not just a quality consideration; it's a credential-protection consideration. See risks of free cheats vs paid cheats, Microsoft Lumma takedown, and pair with our HWID spoofer pillar.
Related Pages
Sources
- Vidar Stealer 2.0 Evolution Analysis — Acronis TRU
- Flare Gaming Malware Research — Flare
- Microsoft Lumma Stealer Takedown — Microsoft
Related Questions
No. RawCheats is in-house engineered, not a reseller storefront. Every product — loader, driver, menu framework, offset pipeline — is developed by our team and shipped to customers under a published subscription model. Refunds, pro-rated detection credit, and PCI-grade payment routing through Stripe and self-hosted BTCPay make this verifiable. The "scam cheat" pattern — unanswered Discord, missing dashboards, vanishing sites — does not match our infrastructure. Trustpilot and forum activity confirm continuous operation.
The Microsoft Lumma takedown was a May 2025 legal and technical operation in which Microsoft's Digital Crimes Unit, in coordination with the US Department of Justice and Europol, obtained federal court orders to seize approximately 2,300 domains operating Lumma Stealer infostealer infrastructure. The majority of seized domains were hosting fake game-cheat installers bundled with the malware, establishing fake cheats as a primary infection vector for credential-theft malware in 2025.
Free cheats from sketchy forums commonly bundle Lumma, Vidar, or RedLine infostealer payloads that exfil browser sessions, Steam tokens, crypto wallets, and saved passwords. Microsoft seized 2,300 Lumma command-and-control domains in May 2025 because free-cheat distribution was the primary delivery channel. Free cheats also detect within days because they''re widely distributed. Paid cheats from established providers don''t bundle malware and ship signature-patches within hours of detection. Risk asymmetry is massive.
Free HWID spoofers in 2026 are mostly infostealer malware — Lumma, Vidar 2.0, RedLine, StealC — disguised as spoofers. Microsoft's Digital Crimes Unit seized 2,300 Lumma distribution domains in May 2025, many hosting fake spoofer installers. Payloads exfiltrate Steam tokens, Discord tokens, browser passwords, crypto wallet keys. Average loss exceeds the cost of a year of paid spoofer. Getting banned in your game is the least bad outcome.
Because "free cheats" are overwhelmingly Lumma or Vidar infostealer payloads disguised as cheat downloads, not real cheats. Microsoft seized 2,300 Lumma domains in May 2025 specifically targeting gaming/cheating-themed lures. Real cheats need full-time engineers reversing anti-cheat updates within 6-12 hours, paid infrastructure, refund handling, and Trustpilot footprint. $4.99 for a 1-day pass is what sustainable engineering costs; "free" is what malware costs you.
