Vidar Stealer Hash-Resolved API Chrome Isolation Desktop Spawn

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•3

Detects the behavioral pattern of Vidar Stealer where it launches Chrome, Edge, or Brave browsers with specific command-line arguments ('--no-first-run', '--disable-gpu', 'about:blank') from a non-browser parent process. This technique is often used by Vidar to facilitate browser data theft while evading static analysis by using process hollowing or similar injection techniques against the spawned browser process.