Tycons.com Chrome EXE Alert: URLhaus Vidar Tag, Account Security and Defender Offline Steps

What was reported​

According to the 2-Spyware write-up, URLhaus listed three file paths at the top level of tycons.com on October 19, 2026:

• ChromeSetup.exe
• google.exe
• Chrome.exe

Bitsight reported them within roughly a minute of each other, between about 18:21 and 18:22 UTC. All three carry the dropped-by-vidar tag, and google.exe also carries a CoinMiner tag. In the publisher's copy of the data, all three were marked online and labeled as malware downloads.

What the tags do and don't prove​

The limits matter here, so they are worth stating plainly:

• "Dropped-by-vidar" says the files were seen being delivered by Vidar samples. It does not say the file is Vidar itself, and it does not identify a build.
• "CoinMiner" appears only on google.exe. It indicates a cryptocurrency miner, which uses your processor to earn money for someone else. No miner family or coin is identified.
• A repeated 32-character tag appears on all three entries. It looks like a hash, but the entry doesn't say so, so it shouldn't be treated as one.
• No one has analyzed the binaries. 2-Spyware says it did not download or analyze the files. Their contents, the Vidar build, the command-and-control server and whether they are still online today are all unconfirmed.
• The homepage proves nothing either way. 2-Spyware reports that one plain request to the tycons.com homepage on October 23 returned status 200, a page titled "TYCOONS" and an nginx server header. A normal front page says nothing about the listed file paths.
• How the files got there is unknown. The site owner may have set this up deliberately, or the site may have been compromised. The report says nothing it read answers that. The domain was registered in 2002, which settles neither question.

If tycons.com only appeared in a firewall log, a block notice or a warning, nothing is proven. The concern is a PC where one of these files was actually run.

Why Chrome-style names are plausible bait​

The file names borrow the name of a very common browser. That makes them easy to overlook in a Downloads folder or in Task Manager. The idea that a person looking for Chrome lands on the wrong download is 2-Spyware's own reading of the names, not a finding from a report. Whether the files imitate Chrome in any way beyond their names is unknown.

For comparison, the real chrome.exe is signed by Google LLC and normally lives in a Google\Chrome\Application folder. 2-Spyware's separate file guide lists Program Files, Program Files (x86) and the per-user LocalAppData location as the genuine folders. A Chrome.exe sitting in Downloads or Temp is not that file.

What Vidar is, as context​

Vidar is a Windows information stealer sold as malware-as-a-service. Palo Alto's Unit 42 described a separate campaign, identified in April 2026, in which malvertising led victims to fake cracked-software downloads. The loader dropped both Vidar and the XMRig miner. Picus Security describes Vidar's primary function as stealing browser credentials, cookies, crypto wallets, cloud tokens and files. Ontinue's analysis of Vidar 2.0 also describes Azure credential targeting, including MSAL token cache theft. Acronis lists malvertising, abused GitHub releases, fake security prompts and spoofed installers among its delivery routes.

This is background on the malware family only. Nothing supplied ties the tycons.com files to the Unit 42 campaign or to Vidar 2.0, and no victim count or operator has been established for them.

If you ran one of these files​

The order matters: secure your accounts from another device first, then deal with the PC.

1. Change passwords from a clean device​

Use a phone or another PC that never touched the files. Start with email, because it can reset everything else. Then do banking, work, cloud storage, social accounts and crypto. The FTC advises a strong, unique password for each account. Assume anything typed on the affected PC while a stealer was running is known.

2. Sign out everywhere and enable two-factor authentication​

The FTC's guidance is to sign out of all devices and turn on two-factor authentication where it's offered. Signing out also helps invalidate stolen session cookies. While you're in each account, check these:

• The recovery email address and phone number should be ones you set.
• Email forwarding rules you didn't create should be deleted.
• Sent and deleted folders may show activity you didn't do.

3. Move crypto first if a wallet lived on the PC​

If a wallet file or seed phrase was ever on that machine, treat it as exposed. Create a new wallet and recovery phrase on a clean device and move the funds there.

4. Run a Microsoft Defender Offline scan​

Microsoft's documentation describes Defender Offline as a scan run from a trusted environment, outside the normal Windows kernel. It is meant for suspected infections.

1. Save your work and close programs. The scan takes about 15 minutes and restarts the PC.
2. If BitLocker protects the system drive, suspend it first. Otherwise the restart may ask for your recovery key.
3. Confirm Windows Recovery Environment is enabled by running reagentc /info. If it shows Disabled, Microsoft's documented fix is reagentc /enable. If WinRE is disabled, Microsoft says the offline scan won't run and shows no error.
4. Open Windows Security > Virus & threat protection > Scan options, choose Microsoft Defender Offline scan, and select Scan now. Approve the prompts. You'll be signed out and Windows will restart into the scan.
5. Afterward, check Protection history under Scan options for results. Menu labels vary slightly between Windows versions.

Microsoft also documents Start-MpWDOScan in PowerShell as an alternative way to start the scan.

Requirements: Microsoft lists x64 Windows 11 and x64/x86 Windows 10, 8.1 and 7 SP1 as supported. ARM versions of Windows 10 and 11 and Windows Server SKUs are excluded. You need local administrator rights, and Microsoft Defender Antivirus must be your primary antivirus, not in passive mode. Windows 7 SP1 and 8.1 need bootable media instead of the built-in one-click option. On Windows 10 and 11 you can confirm the scan was queued in Event Viewer. The path is Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational, where Event ID 2030 records it.

A clean result is one data point. It is not proof that nothing remains. Microsoft's pages also don't name a detection for these particular files.

5. Remove only what you can tie to the download​

Check Startup apps, Task Manager and Settings > Apps > Installed apps for programs that arrived with the download. Don't delete unfamiliar entries on a hunch, because you may break something legitimate. If you can't tell, move to the reset below.

6. When in doubt, reset Windows​

Microsoft documents Reset this PC for Windows 10 and 11. On Windows 11 it is under Settings > System > Recovery. Older Windows 10 builds use Update & Security > Recovery.

• Keep my files reinstalls Windows, removes apps and settings, and preserves personal files.
• Remove everything reinstalls Windows and removes personal files, apps and settings.
• Cloud download fetches a fresh copy of Windows. Local reinstall uses files already on the PC.

For a machine that ran a stealer, 2-Spyware recommends the full wipe because it doesn't depend on finding every component. Back up documents first and have your BitLocker recovery key on hand if the drive is encrypted. Restore documents only, not old programs. Microsoft warns the screen may stay black for a long time, occasionally upwards of 15 minutes. Don't restart manually during the reset, or it could fail.

Also note that Microsoft's support page states that Windows 10 support ended on October 14, 2025. If an affected PC is still on Windows 10, a reset is a good moment to consider moving to Windows 11.

7. Rebuild logins safely​

Avoid letting the browser save passwords again on a machine that was compromised. Use a password manager plus an authenticator app or security key.

8. Watch accounts for a few weeks​

Check card statements, exchange activity and sign-in logs, and turn on alerts. If personal information is stolen, the FTC points to IdentityTheft.gov for a recovery plan. Nothing here confirms identity theft in this incident. It is general guidance.

If you administer a network​

For defenders, the practical response is modest and reversible. The reported hostname and the three paths are reasonable candidates to look for in proxy or DNS logs. A hit means someone's machine contacted the host, not that a payload ran. Where a download did occur, treat that endpoint as potentially compromised. Reset credentials and sessions for the user, review identity sign-in logs and refresh tokens, and consider re-imaging. Browser-stored credentials, cookies and cloud tokens are what stealers like Vidar typically go after.

Bottom line​

A security feed flagged three Chrome-looking executables on a long-registered domain as delivered by Vidar, one with a miner tag. The listing is credible enough to avoid the paths. It is not enough to claim an active campaign, a specific lure or confirmed victims. Don't run anything from that address. If you already did, change your credentials from a clean device before you touch the PC.