Vidar: Fake Notepad++ Malvertising to Data Theft

A developer searched for a popular code editor, clicked a paid search ad, and ran an installer that was not the real thing. Follow the chain from a typosquatted landing page through a dynamic-DNS payload host to the Vidar stealer's dead-drop C2 resolution, then pin down the single hosting address that carried both the stolen data and the malware's orders.