Executive Summary
On February 13, 2026, threat intelligence monitoring detected the first case of infostealer malware exfiltrating AI agent configuration files. While a Vidar Stealer 2.0 infection was the specific malware involved, our analysis reveals the underlying problem is not Vidar-specific: OpenClaw stores gateway tokens, RSA private keys, and behavioral configuration in plaintext files under ~/.openclaw/. Any malware with basic file read capability — or even local user access — can extract these credentials without any specialized module.
This report covers Vidar 2.0's technical architecture as the malware that triggered the incident, but the core finding is an insecure-by-design credential storage model in OpenClaw that makes AI agent identity trivially stealable by any threat.
Background: The Vidar Family
Vidar is a fork of the Arkei infostealer, first observed in late 2018. Over eight years, the family spawned multiple derivatives — Oski, Mars Stealer, and StealC — making it one of the most prolific infostealer lineages in the threat landscape. Open-source threat intelligence databases list 74+ published reports on Vidar variants, tracked by over 30 organizations.
Prevalence surged in late 2025 following the law enforcement takedown of Lumma Stealer infrastructure. With Lumma disrupted, operators migrated to alternatives. Sandbox telemetry ranked Vidar #4 in Q4 2025 with 4,498 detections. International law enforcement operations in 2025 specifically targeted Vidar infrastructure. The 2.0 release landed at the intersection of this demand surge.
Architecture and Anti-Analysis
Vidar 2.0 is a PE32+ x64 executable compiled from pure C (replacing v1.x C++ codebase). The reference sample (bcf8a6..., October 2025) has a .text section of ~342 KB, contains 274 functions, and zero static imports. All Windows API resolution is performed dynamically at runtime.
Control Flow Flattening
Every function is transformed through control flow flattening (CFF). Each function body is converted into a state machine driven by magic number comparisons. The original control flow graph is replaced by a flat while(true) loop containing a switch-equivalent dispatcher. State transitions use hardcoded magic numbers such as 0xef25c2e, -0x1ccdc046, and 0x3faa991b. Applied across all 274 functions, making decompiler output largely unreadable without manual intervention.
Polymorphic builder: Vidar 2.0 generates a unique binary per build. While functional logic remains constant, structural variation means simple byte-pattern signatures are unreliable. Detection must target behavioral patterns and string constants.
Anti-Debug and Self-Deletion
Execution Flow
nss3.dll, mozglue.dll, etc.).multipart/form-data with 20-char random boundaries. Fields: token, profile, hwid, file, build_id, mode. SSL validation disabled. Self-deletes on completion.
https://telegram[.]me/ahnadar
https://steamcommunity[.]com/profiles/76561198780411257
Extracted domain: xp.lorenabulei[.]com
Internally, the configuration is stored in a VidarConfig struct: data_buffer[0x200] at offset 0x0, server_address at +0x200, and token at +0x300. The User-Agent string is hardcoded:
Data Targeting Capabilities
Vidar 2.0's theft capabilities fall into two categories: hardcoded modules targeting specific applications with dedicated parsing logic, and a configurable file grabber that sweeps arbitrary directories based on C2-provided configuration.
Image: Cloud Credential Theft - CFF DecompileDecompiled mal_stealcloudcreds function showing control flow flattening and calls to mal_findazure, mal_findaws, mal_msalidentity.
Browser Credentials
Targets Chrome, Edge, Firefox, Opera, Vivaldi, Waterfox, and Palemoon. Implements a complete Chrome AppBound cookie bypass (effective against Chrome v127+):
Browser attack chain - compactChrome AppBound Bypass Chain
browser_v20_key_extraction at 0x14001379d extracts v20 key from Local State
BCryptOpenAlgorithmProvider → BCryptSetProperty → BCryptGenerateSymmetricKey → BCryptDecrypt
CryptUnprotectData for older Chrome versions
validate_v20_key at 0x1400154f0, queue_v20_key_upload at 0x1400157fb
Cloud Credentials (New in 2.0)
Ghidra decompile of FUN_14003eaf4 (steal_azure_msal_userprofile) — reads USERPROFILE environment variable, constructs paths to Azure/.IdentityService directories, validates with GetFileAttributesA. Note the control flow flattening state machine.
Vidar 2.0 includes purpose-built cloud credential theft. The data classification function at 0x1400042fd labels stolen tokens as "Azure Reader" — confirming this is intentional targeting, not incidental collection.
Additional Targets
The recursive_file_stealer_engine operates on directory-name matching — not content inspection. It uses FindFirstFileA/FindNextFileA for enumeration and validates paths with GetFileAttributesA. Pattern list is configurable per campaign via C2.
The OpenClaw Exposure: Insecure by Design
Vidar 2.0 was the malware that triggered this incident — but our analysis concludes that the vulnerability is in OpenClaw, not in Vidar. OpenClaw stores all authentication material as plaintext files in the user's home directory. No encryption, no OS credential store integration (Windows DPAPI, macOS Keychain, Linux Secret Service), and no filesystem access controls beyond default permissions.
Core Finding - Red calloutAny malware with basic file read capability — or even local user access — can extract a victim's full AI agent identity. No specialized infostealer module, no reverse engineering of OpenClaw's protocol, and no exploitation of any CVE is required. A simple cat ~/.openclaw/openclaw.json is sufficient.
What Is Stored in Plaintext
The ~/.openclaw/ directory contains the following files, all readable by any process running as the user:
With these files, an attacker can impersonate the victim's AI agent, make API calls on their behalf, access their workspace, and extract proprietary system prompts — all without ever authenticating.
Why This Is Not a Vidar Problem
Vidar's recursive_file_stealer_engine collected these files because the C2 operator configured .openclaw as a directory-name pattern. There is no dedicated OpenClaw module in the binary. Any malware family with file enumeration capability — Lumma, RedLine, Raccoon, StealC, or even a basic RAT — can replicate this theft with equal ease. The barrier to entry is zero because the secrets require no decryption.
Contrast: Browser Credentials vs OpenClaw Credentials
Browsers store passwords using AES-256-GCM encryption with DPAPI-protected keys. Stealing them requires a multi-step decryption chain (BCryptOpenAlgorithmProvider → BCryptDecrypt) that only purpose-built infostealers implement. OpenClaw credentials require no decryption at all — they are readable as-is from disk.
This means the attack surface for OpenClaw credential theft is fundamentally larger than browser credential theft: every file-reading malware is an OpenClaw credential stealer by default.
Known CVEs
Multiple CVEs have been assigned to OpenClaw's credential handling and related vulnerabilities:
CVE-2026-25253
Remote Code Execution via crafted workspace files
CVE-2026-27001
Prompt injection via tool output
CVE-2026-26325
Authentication bypass in gateway token validation
CVE-2026-26327
Insufficient credential storage protection
CVE-2026-24763
Unauthorized file access via path traversal
Evidence: The February 13 Incident
On February 13, 2026, threat intelligence platforms detected stolen OpenClaw configuration files from an infostealer infection. The exfiltrated data included 14 files from the victim's ~/.openclaw/ directory:
Stolen ~/.openclaw/ directory contents — 14 matching files exfiltrated.
Contents of the stolen openclaw.json — gateway token, workspace path, victim email, and OAuth credentials stored in plaintext.
Detection and Hunting Guidance
Network Indicators
45.139.186.93:80 — Payload delivery
147.45.44.209 — Dec 2025–Jan 2026 campaigns
xp.lorenabulei[.]com — Dead-drop extracted domain
SSL Certificate DN: C=XX, ST=NY, L=NY, O=StaticIP
Endpoint Indicators
Behavioral Detection Opportunities
RegAsm.exe spawned by suspicious parent process
cmd.exe /c timeout /t 10 & rd /s /q command line
nss3.dll, mozglue.dll, softokn3.dll, freebl3.dll
BCryptOpenAlgorithmProvider → BCryptDecrypt from non-browser process
multipart/form-data containing fields: token, profile, hwid, file
telegram.me or steamcommunity.com profile pages
Mitigation and Remediation
If Compromised
Immediate Response Actions
OpenClaw-Specific Remediation
OpenClaw Hardening
openclaw.json authentication tokens and device.json RSA key pairs
~/.openclaw/ access — Alert on non-OpenClaw processes reading this directory
openclaw-security-monitor
Preventive Hardening
Reduce Attack Surface
telegram.me and steamcommunity.com to break dead-drop resolution.
RegAsm.exe process injection.
