Threat reportMalwareTL-2026-1183
Vidar Infostealer and XMRig Cryptominer Malvertising Campaign Targeting SMBs (Factory-v3 / X3D MINER)
Vidar Infostealer and XMRig Cryptominer Malvertising (TL-2026-1183), also tracked as Factory-v3 Vidar/XMRig Campaign, is a medium-severity malware campaign, first published 2026-07-10. It is attributed to X3D MINER with medium confidence, affects Microsoft Windows (consumer and SMB endpoints), maps to 29 MITRE ATT&CK techniques (T1005, T1016.001, T1027), and is covered by 9 detection rules and 28 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 29MITRE ATT&CK
- Actors
- 1X3D MINER
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 28Indicators of compromise
Key facts for TL-2026-1183
- Threat ID
- TL-2026-1183
- Also known as
- Factory-v3 Vidar/XMRig Campaign, UpdateFactory Malvertising Campaign, X3D MINER Campaign
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- X3D MINER
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- smallandmediumbusiness, consumer, retail, professionalservices
- Target regions
- North America, Europe
- Detection rules
- 9
- Indicators of compromise
- 28
Malware and tooling in Vidar Infostealer and XMRig Cryptominer Malvertising
Malware and tooling: Vidar, xmrig, Factory-v3, Telegram Bot API
How Vidar Infostealer and XMRig Cryptominer Malvertising works
Unit 42 uncovered a financially motivated malvertising campaign, active since April 2026, that lures consumers and SMBs into downloading password-protected .bin archives disguised as cracked software. A Go-compiled loader built on the Factory-v3 malware-as-a-service framework drops both Vidar stealer and the XMRig cryptominer, using fabricated JustWatch/BleacherReport code-signing certificates, ~491MB null-byte file inflation, and an in-memory AMSI patch to evade SMB-grade defenses.
In mid-to-late April 2026, Unit 42 identified a dual-payload campaign delivering Vidar infostealer and the open-source XMRig Monero miner to consumer and SMB victims, primarily in the U.S. and European Union. Victims searching for pirated/cracked copies of copyrighted software are lured via malvertising to download password-protected archives with a .bin extension — a deliberate choice to defeat email-gateway scanning and block automated sandbox detonation without the password.
Inside the archive is a Go-compiled loader built on the Factory-v3 (a.k.a. UpdateFactory) malware-as-a-service builder framework, the same upstream infrastructure used concurrently by Lumma stealer operators, indicating a shared criminal supply chain. Unit 42 catalogued 99 loader samples across four clusters: Cluster A (26 x64 EXE Go loaders, file-inflated), Cluster B (13 x64 DLLs masquerading as Windows Defender's MpClient.dll for DLL search-order hijacking), Cluster C (3 x86 Go loaders), and Cluster D (1 Vidar core payload). 27 unique build UUIDs were embedded across the 43 primary samples specifically to defeat hash-based detection.
The loader executable is padded with hundreds of megabytes of null bytes appended after the last PE section — one sample reached 491MB on disk while containing only 2.3MB of actual malicious code (compressing back down to ~2.4MB). This inflation is engineered to exceed the file-size ceilings (typically 50-100MB) enforced by automated sandbox and EDR pre-filters, particularly at SMBs that rely on default or budget-tier security stacks.
Code-signing is abused via two fabricated certificate chains rather than a genuine compromise of either brand: Variant A (initial, 2026-03-09 through 2026-06-07) impersonates justwatch[.]com, self-signed under a rogue CA labeled 'WR3'; Variant B (introduced 2026-04-24) impersonates *.bleacherreport[.]com under a cloned 'GlobalSign Atlas R3 DV TLS CA 2026 Q1' issuer chain. Neither JustWatch GmbH nor Bleacher Report was compromised — the certificates are entirely fabricated and are not trusted by Windows SmartScreen, but the impersonation still defeats naive allow-listing and analyst triage that pattern-matches on subject CN. The loader binaries additionally zero the PE TimeDateStamp, strip version-info resources, trim DLL imports down to kernel32.dll only, and rename user-defined types to a generic V###### pattern to blunt static/behavioral signatures.
On execution, the loader performs an in-memory AMSI bypass: it loads amsi.dll, resolves the AmsiScanBuffer address, and overwrites the function's first six bytes to force a hard-coded E_INVALIDARG return, blinding AMSI-integrated AV/EDR before the stealer logic runs. Sensitive strings (Telegram bot token, Monero wallet address, mining pool hostname) are protected in the binary with a 32-byte rotating XOR key and only decrypted in memory immediately before use; DLL/API names used by the bypass are obfuscated with a trivial single-byte XOR (key 0x05).
After defense evasion, the loader performs process enumeration and proxy-bypass reconnaissance, then beacons to ip-api[.]com/json to geolocate the victim, embedding IP/country in an operator-facing Telegram alert tagged 'X3D MINER • NEW LOG' (Variant B alerts to Telegram channel ci0iiif). It then drops both payloads: Vidar stealer (dropped as MicrosoftUpdate.exe in %TEMP%, persistence copy as NisSrv.exe under %AppData%\Roaming\Microsoft\Windows\Temp) harvests browser-stored credentials, cookies, and cryptocurrency wallet data, zips it, and exfiltrates over TLS to one of four Hetzner-hosted VPS C2 IPs. XMRig (dropped as MicrosoftEdgeUpdate.exe with libuv-1.dll and the WinRing0x64.sys kernel driver, config built in memory as mgwthmc2.dat) connects to pool.supportxmr[.]com and hashes the victim's C: volume serial number into an 8-character HWID appended to the pool auth_token for per-victim tracking on the Monero pool dashboard.
Persistence for NisSrv.exe (filename mimics the legitimate Windows Defender Network Inspection Service binary) is established redundantly via an HKCU Run key (value SystemAgentService), a schtasks /sc onlogon task of the same name, and a Startup-folder batch script (FEbJCNWOCKMJ.bat) — triple redundancy ensuring survival of partial remediation.
Attribution: the operator is assessed as a Vidar MaaS affiliate using the 'X3D MINER' Telegram tag, previously associated with delivering and binding XMRig with other malware. The 99-sample set implies at least two distinct infostealer affiliates independently drawing on the same Factory-v3 builder service, consistent with a broader criminal-supply-chain pattern also feeding Lumma stealer operations. Monetization is dual-track: stolen credentials/session cookies are sold on criminal log markets while XMRig provides ongoing passive CPU-hijacking revenue from the same compromised host.
MITRE ATT&CK techniques used in TL-2026-1183
Collection
T1005 Data from Local System; T1560.001 Archive via Utility
Discovery
T1016.001 Internet Connection Discovery; T1057 Process Discovery; T1082 System Information Discovery
Defense Evasion
T1027 Obfuscated Files or Information; T1027.001 Binary Padding; T1036.001 Invalid Code Signature; T1036.005 Match Legitimate Resource Name or Location; T1070.006 Timestomp; T1140 Deobfuscate/Decode Files or Information; T1497.001 System Checks
Exfiltration
T1041 Exfiltration Over C2 Channel
Persistence
T1053.005 Scheduled Task; T1547.001 Registry Run Keys / Startup Folder
Command and Control
T1071.001 Web Protocols; T1102.002 Bidirectional Communication; T1573.001 Symmetric Cryptography
Initial Access
Execution
Impact
Credential Access
T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers
defense-impairment
T1553.003 SIP and Trust Provider Hijacking; T1685 Disable or Modify Tools
stealth
Resource Development
T1583.003 Virtual Private Server; T1585.001 Social Media Accounts; T1588.001 Malware
Affected products and versions in Vidar Infostealer and XMRig Cryptominer Malvertising
- Microsoft — Windows (consumer and SMB endpoints)
Vulnerable versions: Windows 10; Windows 11
Remediation for Vidar Infostealer and XMRig Cryptominer Malvertising
Immediate actions
- Block outbound connections to Vidar C2 IPs: 136.243.203.109, 136.243.203.111, 116.203.243.208, 138.199.246.13
- Block/monitor connections to pool.supportxmr[.]com and other public Monero mining pools
- Alert on and quarantine password-protected .bin archive attachments/downloads at the email gateway and web proxy
- Hunt for NisSrv.exe outside C:\Windows\System32 (legitimate Network Inspection Service path) and MicrosoftUpdate.exe/MicrosoftEdgeUpdate.exe running from %TEMP%/%AppData%
- Search for the SystemAgentService Run key and scheduled task name across endpoints
- Hunt for oversized (>200MB) signed EXE/DLL with a disproportionately small entropy-dense code section (loader file-inflation signature)
Workarounds
- Restrict execution of archive-extracted binaries from Downloads/Temp directories via Software Restriction Policies
Longer-term hardening
- Raise or remove sandbox/EDR file-size analysis ceilings, or add a heuristic that strips trailing null-byte padding before size-gating
- Deploy AMSI provider integrity monitoring / detect in-memory patches to AmsiScanBuffer
- Enforce application allow-listing (WDAC/AppLocker) rather than trusting code-signing subject CN alone, since certificates here are fabricated but chain-plausible
- Educate SMB users against downloading cracked/pirated software via search-ad malvertising
- Deploy DNS/web filtering that blocks known malvertising ad networks and newly-registered lookalike domains
Weaknesses (CWE) in Vidar Infostealer and XMRig Cryptominer Malvertising
Timeline of Vidar Infostealer and XMRig Cryptominer Malvertising
- Fabricated self-signed 'justwatch[.]com' code-signing certificate (Variant A, issuer 'WR3') validity period begins.
- Malvertising activity spike begins, luring victims with fake cracked-software downloads targeting U.S. and EU consumers/SMBs.
- Operators roll out Variant B loaders using a cloned certificate chain impersonating *.bleacherreport[.]com and a 'GlobalSign Atlas R3 DV TLS CA 2026 Q1' issuer; Variant B beacons to a new Telegram channel (ci0iiif).
- Variant A JustWatch-impersonating certificate validity period ends.
- Security Boulevard publishes coverage summarizing the dual-payload credential-theft/cryptomining scheme.
- Unit 42 (Palo Alto Networks) publishes technical analysis 'Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation', detailing 99 samples across four clusters, the Factory-v3 MaaS framework, and full IOC set.
- Brinztech and independent researcher forums (MalwareTips) publish supplementary analysis of the loader-as-a-service framework and DLL sideloading mechanics.
- Dark Reading and Infosecurity Magazine publish broader industry coverage of the campaign, framing it as an SMB-targeted threat.
- TL-Intel Harness RESEARCH phase compiles and correlates all available open-source reporting into this threat record.
Sources cited for Vidar Infostealer and XMRig Cryptominer Malvertising
- Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation
- Vidar Infostealer Hammers SMBs via Malvertising Campaign
- New Malicious Campaign Delivers Vidar Stealer and Monero Crypto Miner
- Vidar Malware Campaign Uses Fake Software Downloads to Steal Credentials and Mine Cryptocurrency
- Brinztech Alert: Analysis of Dual-Payload Vidar/XMRig Malvertising Campaign
- Unit 42 Researchers exposed a new Vidar campaign using a loader-as-a-service framework, DLL sideloading with a Go-compiled fake MpClient.dll
Detection coverage for TL-2026-1183
As of 2026-07-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1183 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.