Vidar cryptocurrency wallet file enumeration and access

Ethan Andrews@eandrews

•updated Jul 2, 2026•2•0•4

This rule detects unauthorized access attempts to common cryptocurrency wallet data files and Telegram Desktop session information, a pattern of behavior consistent with the data collection phase of the Vidar information stealer.