Vidar - Base64 Image Steganography Fetch (T1027)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•1

Detects PowerShell connecting to an IP to download an image file containing embedded Base64 markers (<<BASE64_START>>). This behavior is associated with the Vidar stealer, which uses steganography to hide its payload within image files.