Vidar - AutoIt Interpreter Malicious Script Execution

Ibrahim Saud@tektrix

•updated Jun 21, 2026•1•0•3

Detects the execution of the legitimate AutoIt3.exe interpreter launching a script (either .au3 or .a3x) that also initiates network connections to non-localhost IP addresses. This behavior is indicative of malicious activity, such as that observed with the Vidar stealer.