Vidar v1.5 in Go: same family, new language, heavy sandbox checks

Reported 18 May 2026 by otx · Severity: medium

Vidar is a name most infostealer trackers know well -- an Arkei descendant that has been snatching browser credentials and crypto wallets since 2018. It usually ships as a .NET binary or a C++ PE. The v1.5 sample we pulled from Triage on May 13, 2026 is neither. It is a 7 MB Go 1