New Vidar Stealer Campaign Targets User Credentials

In the shadowy world of cyber espionage, a single click on what appears to be a routine airline e-ticket can silently surrender a network to nation-state hackers.

Researchers at the Genians Security Center have uncovered a sophisticated new campaign linked to North Korea’s notorious APT37 group.

Using cleverly disguised Python malware and a maze of obfuscated commands, these threat actors are quietly infiltrating the defense, police, and geopolitical research sectors.

Vidar Campaign Steals Credentials

The attack begins with highly targeted spear-phishing emails designed to lower a victim’s guard. Threat actors lure targets with attachments impersonating event invitations, police documents, or airline confirmations.

These emails contain a ZIP archive holding a malicious Windows Shortcut (LNK) file. When a victim opens the file, a decoy document appears on the screen. At the same time, a silent, multi-stage infection chain runs in the background.

To evade detection, the attackers use a clever technique to expand environment variable substrings.

Instead of running a direct command, the LNK file pieces together its malicious instructions character by character at runtime.

This initial script uses the built-in Windows curl.exe tool to connect to a remote server and download a secondary batch (BAT) file.

From here, the campaign takes a unique approach to establishing a foothold. The batch script downloads a legitimate Python embed package directly from the official Python website.

To hide its tracks, it deletes the standard execution files and renames pythonw.exe to codeflush.exe.

This allows the malware to run entirely in the background without triggering typical antivirus alarms associated with unauthorized software installations.

Once active, the Python backdoor functions as a Remote Access Trojan (RAT). It generates a unique identifier for the infected machine, communicates with a command-and-control (C2) server, and waits for further instructions.

Because it dynamically receives and executes Python code from the attackers, the backdoor can steal credentials, exfiltrate sensitive files, or deploy additional malware at will.

Genians said, this campaign shares deep technical DNA with previous APT37 operations.

The threat group, widely believed to operate under North Korea’s state intelligence apparatus, has a history of using similar infrastructure.

Researchers noted identical C2 IP addresses, overlapping code obfuscation techniques, and the continued abuse of Korean web hosting services such as Cafe24, alongside French domains.

The repeated appearance of the user account “Lailey” in decoy documents further links this attack to historical campaigns targeting human rights and unification organizations.

Indicators of Compromise (IOCs)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.