Vidar Stealer Runtime API Hash Resolution — Suspicious Chrome Spawn with Injection Flags

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•3

This rule detects Vidar Stealer activity through two primary methods: a hash-based detection for a known Vidar 2.1 sample and a behavioral detection for non-standard parent processes spawning Chrome with specific command-line arguments. The behavioral detection targets Vidar's technique of using hash-resolved API calls (CreateNamedPipeA and WaitForSingleObject) to orchestrate APC injection into a suspended Chrome process for credential theft.