AI Brands as Bait - Pythonw AppData Exec to Vidar C2

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•1

This rule detects the execution of 'pythonw.exe' from the AppData\Local folder, which then initiates network connections to known Vidar C2 domains (brokeapt.com, pan.ssffaa19.xyz, pan.rongtv.xyz). This behavior is indicative of the Vidar stealer malware, often distributed via social engineering campaigns leveraging AI brands as bait.