Vidar Infostealer Credential Store Access Following ClickFix Execution Chain

Duo Tech@duotech

•updated Jul 20, 2026•2•0•8

Detects suspicious processes (PowerShell, MSHTA, WScript, CScript, or CMD) attempting to read sensitive browser or wallet files (Login Data, Cookies, Local State, etc.). This behavior is frequently associated with information stealers attempting to extract credentials and sensitive information from local endpoints.