--- title: Hacked sites deliver Vidar infostealer to Windows users description: Malwarebytes researchers uncovered a campaign distributing the Vidar infostealer via fake CAPTCHA pages hosted on compromised WordPress sites. Victims are... canonical: https://daily.dev/posts/hacked-sites-deliver-vidar-infostealer-to-windows-users-hv8wpqgjz twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Hacked sites deliver Vidar infostealer to Windows users | daily.dev og:description: Malwarebytes researchers uncovered a campaign distributing the Vidar infostealer via fake CAPTCHA pages hosted on compromised WordPress sites. Victims are... og:url: https://daily.dev/posts/hacked-sites-deliver-vidar-infostealer-to-windows-users-hv8wpqgjz og:image: https://api.daily.dev/og/posts/HV8wPqgJz.png og:image:alt: Hacked sites deliver Vidar infostealer to Windows users og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Hacked sites deliver Vidar infostealer to Windows users **[Security Boulevard](https://daily.dev/sources/securityboulevard)** · 6 min read · 0 upvotes · 0 comments ## Summary Malwarebytes researchers uncovered a campaign distributing the Vidar infostealer via fake CAPTCHA pages hosted on compromised WordPress sites. Victims are tricked into running an mshta command that triggers an obfuscated HTA script, which downloads a malicious MSI installer. The MSI executes a GoLang loader that performs anti-analysis checks before decrypting and loading Vidar directly into memory. Vidar harvests browser credentials, cryptocurrency wallets, session cookies, and payment data. The campaign has affected sites in Italy, France, the US, the UK, and Brazil. Indicators of compromise are provided, along with practical advice on avoiding ClickFix-style social engineering attacks. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Australia warns of ClickFix attacks pushing Vidar Stealer malware](https://daily.dev/posts/australia-warns-of-clickfix-attacks-pushing-vidar-stealer-malware-weapq5ob2) · BleepingComputer · 2 upvotes · 0 comments - [Vidar Rises to Top of Chaotic Infostealer Market](https://daily.dev/posts/vidar-rises-to-top-of-chaotic-infostealer-market-st4mtndss) · Dark Reading · 0 upvotes · 0 comments - [Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation](https://daily.dev/posts/vidar-stealer-unmasked-code-signing-abuse-go-loaders-and-file-inflation-s7llrmdds) · Unit 42 · 0 upvotes · 0 comments - [ClickFix techniques evolve in new infostealer campaigns](https://daily.dev/posts/clickfix-techniques-evolve-in-new-infostealer-campaigns-mufrpsfhw) · CSO Online · 0 upvotes · 0 comments - [Fast, Broad, and Elusive: How Vidar Stealer 2.0 Upgrades Infostealer Capabilities](https://daily.dev/posts/fast-broad-and-elusive-how-vidar-stealer-2-0-upgrades-infostealer-capabilities-91sk99hum) · Trend Micro · 0 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#wordpress](https://daily.dev/tags/wordpress), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/hacked-sites-deliver-vidar-infostealer-to-windows-users-hv8wpqgjz) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Hacked sites deliver Vidar infostealer to Windows users","url":"https://daily.dev/posts/hacked-sites-deliver-vidar-infostealer-to-windows-users-hv8wpqgjz","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/hacked-sites-deliver-vidar-infostealer-to-windows-users-hv8wpqgjz"},"datePublished":"2026-03-16T17:57:24.877Z","dateModified":"2026-03-16T17:57:57.682Z","description":"Malwarebytes researchers uncovered a campaign distributing the Vidar infostealer via fake CAPTCHA pages hosted on compromised WordPress sites. Victims are...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8fe9eeb967de205fd6743e2535f16178?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8fe9eeb967de205fd6743e2535f16178?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Security Boulevard","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Security Boulevard","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/3613c832180040de8d85bb29f74395be","url":"https://daily.dev/sources/securityboulevard"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/hacked-sites-deliver-vidar-infostealer-to-windows-users-hv8wpqgjz","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,wordpress,malware","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Security Boulevard","item":"https://daily.dev/sources/securityboulevard"},{"@type":"ListItem","position":3,"name":"Hacked sites deliver Vidar infostealer to Windows users"}]} ```