Vidar Infostealer and XMRig Cryptominer Malvertising Campaign Targeting SMBs (Factory-v3 / X3D MINER) — Threadlinqs Intelligence
As of 2026-07-10, Vidar Infostealer and XMRig Cryptominer Malvertising Campaign Targeting SMBs (Factory-v3 / X3D MINER) is a medium-severity malware threat attributed to X3D MINER, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 28 indicators of compromise.
Threat ID: TL-2026-1183 · Severity: MEDIUM · Status: ACTIVE · Category: MALWARE
Attribution: X3D MINER · FINANCIAL
Unit 42 uncovered a financially motivated malvertising campaign, active since April 2026, that lures consumers and SMBs into downloading password-protected .bin archives disguised as cracked software.
In mid-to-late April 2026, Unit 42 identified a dual-payload campaign delivering Vidar infostealer and the open-source XMRig Monero miner to consumer and SMB victims, primarily in the U.S. and European Union. Victims searching for pirated/cracked copies of copyrighted software are lured via malvertising to download password-protected archives with a .bin extension — a deliberate choice to defeat email-gateway scanning and block automated sandbox detonation without the password.
Inside the archive is a Go-compiled loader built on the Factory-v3 (a.k.a. UpdateFactory) malware-as-a-service builder framework, the same upstream infrastructure used concurrently by Lumma stealer operators, indicating a shared criminal supply chain. Unit 42 catalogued 99 loader samples across four clusters: Cluster A (26 x64 EXE Go loaders, file-inflated), Cluster B (13 x64 DLLs masquerading as Windows Defender's MpClient.dll for DLL search-order hijacking), Cluster C (3 x86 Go loaders), and Cluster D (1 Vidar core payload). 27 unique build UUIDs were embedded across the 43 primary samples specifically to defeat hash-based detection.
The loader executable is padded with hundreds of megabytes of null bytes appended after the last PE section — one sample reached 491MB on disk while containing only 2.3MB of actual malicious code (compressing back down to ~2.4MB). This inflation is engineered to exceed the file-size ceilings (typically 50-100MB) enforced by automated sandbox and EDR pre-filters, particularly at SMBs that rely on default or budget-tier security stacks.
Code-signing is abused via two fabricated certificate chains rather than a genuine compromise of either brand: Variant A (initial, 2026-03-09 through 2026-06-07) impersonates justwatch[.]com, self-signed under a rogue CA labeled 'WR3'; Variant B (introduced 2026-04-24) impersonates *.bleacherreport[.]com under a cloned 'GlobalSign Atlas R3 DV TLS CA 2026 Q1' issuer chain. Neither JustWatch GmbH nor Bleacher Report was compromised — the certificates are entirely fabricated and are not trusted by Windows SmartScreen, but the impersonation still defeats naive allow-listing and analyst triage that pattern-matches on subject CN. The loader binaries additionally zero the PE TimeDateStamp, strip version-info resources, trim DLL imports down to kernel32.dll only, and rename user-defined types to a generic V###### pattern to blunt static/behavioral signatures.
On execution, the loader performs an in-memory AMSI bypass: it loads amsi.dll, resolves the AmsiScanBuffer address, and overwrites the function's first six bytes to force a hard-coded E_INVALIDARG return, blinding AMSI-integrated AV/EDR before the stealer logic runs. Sensitive strings (Telegram bot token, Monero wallet address, mining pool hostname) are protected in the binary with a 32-byte rotating XOR key and only decrypted in memory immediately before use; DLL/API names used by the bypass are obfuscated with a trivial single-byte XOR (key 0x05).
After defense evasion, the loader performs process enumeration and proxy-bypass reconnaissance, then beacons to ip-api[.]com/json to geolocate the victim, embedding IP/country in an operator-facing Telegram alert tagged 'X3D MINER • NEW LOG' (Variant B alerts to Telegram channel ci0iiif). It then drops both payloads: Vidar stealer (dropped as MicrosoftUpdate.exe in %TEMP%, persistence copy as NisSrv.exe under %AppData%\Roaming\Microsoft\Windows\Temp) harvests browser-stored credentials, cookies, and cryptocurrency wallet data, zips it, and exfiltrates over TLS to one of four Hetzner-hosted VPS C2 IPs. XMRig (dropped as MicrosoftEdgeUpdate.exe with libuv-1.dll and the WinRing0x64.sys kernel driver, config built in memory as mgwthmc2.dat) connects to pool.supportxmr[.]com and hashes the victim's C: volume serial number into an 8-character HWID appended to the pool auth_token for per-victim tracking on the Monero pool dashboard.
Persistence for NisSrv.exe (filename mimics the legitimate Windows D
Weaknesses (CWE)
CWE-506, CWE-494, CWE-295
Target sectors: smallandmediumbusiness, consumer, retail, professionalservices
Target regions: North America, Europe
Detections & IOCs
As of 2026-08-25, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 28 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, MEDIUM, threat intelligence, cybersecurity, T1189, T1204.002, T1547.001, T1053.005, T1574.001, T1036.005, T1036.001, T1027, T1027.001, T1685
