# Vidar Infostealer and XMRig Cryptominer Malvertising Campaign Targeting SMBs (Factory-v3 / X3D MINER)

> Unit 42 uncovered a financially motivated malvertising campaign, active since April 2026, that lures consumers and SMBs into downloading password-protected .bin archives disguised as cracked software. A Go-compiled loader built on the Factory-v3 malware-as-a-service framework drops both Vidar stealer and the XMRig cryptominer, using fabricated JustWatch/BleacherReport code-signing certificates, ~491MB null-byte file inflation, and an in-memory AMSI patch to evade SMB-grade defenses.

- **Published:** 2026-07-10T00:00:00Z
- **Last reviewed:** 2026-07-10T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1183
- **ID:** TL-2026-1183
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** X3D MINER
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)

## Description

In mid-to-late April 2026, Unit 42 identified a dual-payload campaign delivering Vidar infostealer and the open-source XMRig Monero miner to consumer and SMB victims, primarily in the U.S. and European Union. Victims searching for pirated/cracked copies of copyrighted software are lured via malvertising to download password-protected archives with a .bin extension — a deliberate choice to defeat email-gateway scanning and block automated sandbox detonation without the password.

Inside the archive is a Go-compiled loader built on the Factory-v3 (a.k.a. UpdateFactory) malware-as-a-service builder framework, the same upstream infrastructure used concurrently by Lumma stealer operators, indicating a shared criminal supply chain. Unit 42 catalogued 99 loader samples across four clusters: Cluster A (26 x64 EXE Go loaders, file-inflated), Cluster B (13 x64 DLLs masquerading as Windows Defender's MpClient.dll for DLL search-order hijacking), Cluster C (3 x86 Go loaders), and Cluster D (1 Vidar core payload). 27 unique build UUIDs were embedded across the 43 primary samples specifically to defeat hash-based detection.

The loader executable is padded with hundreds of megabytes of null bytes appended after the last PE section — one sample reached 491MB on disk while containing only 2.3MB of actual malicious code (compressing back down to ~2.4MB). This inflation is engineered to exceed the file-size ceilings (typically 50-100MB) enforced by automated sandbox and EDR pre-filters, particularly at SMBs that rely on default or budget-tier security stacks.

Code-signing is abused via two fabricated certificate chains rather than a genuine compromise of either brand: Variant A (initial, 2026-03-09 through 2026-06-07) impersonates justwatch[.]com, self-signed under a rogue CA labeled 'WR3'; Variant B (introduced 2026-04-24) impersonates *.bleacherreport[.]com under a cloned 'GlobalSign Atlas R3 DV TLS CA 2026 Q1' issuer chain. Neither JustWatch GmbH nor Bleacher Report was compromised — the certificates are entirely fabricated and are not trusted by Windows SmartScreen, but the impersonation still defeats naive allow-listing and analyst triage that pattern-matches on subject CN. The loader binaries additionally zero the PE TimeDateStamp, strip version-info resources, trim DLL imports down to kernel32.dll only, and rename user-defined types to a generic V###### pattern to blunt static/behavioral signatures.

On execution, the loader performs an in-memory AMSI bypass: it loads amsi.dll, resolves the AmsiScanBuffer address, and overwrites the function's first six bytes to force a hard-coded E_INVALIDARG return, blinding AMSI-integrated AV/EDR before the stealer logic runs. Sensitive strings (Telegram bot token, Monero wallet address, mining pool hostname) are protected in the binary with a 32-byte rotating XOR key and only decrypted in memory immediately before use; DLL/API names used by the bypass are obfuscated with a trivial single-byte XOR (key 0x05).

After defense evasion, the loader performs process enumeration and proxy-bypass reconnaissance, then beacons to ip-api[.]com/json to geolocate the victim, embedding IP/country in an operator-facing Telegram alert tagged 'X3D MINER • NEW LOG' (Variant B alerts to Telegram channel ci0iiif). It then drops both payloads: Vidar stealer (dropped as MicrosoftUpdate.exe in %TEMP%, persistence copy as NisSrv.exe under %AppData%\Roaming\Microsoft\Windows\Temp) harvests browser-stored credentials, cookies, and cryptocurrency wallet data, zips it, and exfiltrates over TLS to one of four Hetzner-hosted VPS C2 IPs. XMRig (dropped as MicrosoftEdgeUpdate.exe with libuv-1.dll and the WinRing0x64.sys kernel driver, config built in memory as mgwthmc2.dat) connects to pool.supportxmr[.]com and hashes the victim's C: volume serial number into an 8-character HWID appended to the pool auth_token for per-victim tracking on the Monero pool dashboard.

Persistence for NisSrv.exe (filename mimics the legitimate Windows Defender Network Inspection Service binary) is established redundantly via an HKCU Run key (value SystemAgentService), a schtasks /sc onlogon task of the same name, and a Startup-folder batch script (FEbJCNWOCKMJ.bat) — triple redundancy ensuring survival of partial remediation.

Attribution: the operator is assessed as a Vidar MaaS affiliate using the 'X3D MINER' Telegram tag, previously associated with delivering and binding XMRig with other malware. The 99-sample set implies at least two distinct infostealer affiliates independently drawing on the same Factory-v3 builder service, consistent with a broader criminal-supply-chain pattern also feeding Lumma stealer operations. Monetization is dual-track: stolen credentials/session cookies are sold on criminal log markets while XMRig provides ongoing passive CPU-hijacking revenue from the same compromised host.

## MITRE ATT&CK

- T1189 Drive-by Compromise
- T1204.002 Malicious File
- T1547.001 Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task
- T1574.001 DLL
- T1036.005 Match Legitimate Resource Name or Location
- T1036.001 Invalid Code Signature
- T1027 Obfuscated Files or Information
- T1027.001 Binary Padding
- T1685 Disable or Modify Tools
- T1070.006 Timestomp
- T1140 Deobfuscate/Decode Files or Information
- T1497.001 System Checks
- T1553.003 SIP and Trust Provider Hijacking
- T1057 Process Discovery
- T1016.001 Internet Connection Discovery
- T1082 System Information Discovery
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1005 Data from Local System
- T1560.001 Archive via Utility
- T1071.001 Web Protocols
- T1102.002 Bidirectional Communication
- T1573.001 Symmetric Cryptography
- T1041 Exfiltration Over C2 Channel
- T1496 Resource Hijacking
- T1588.001 Malware
- T1583.003 Virtual Private Server
- T1585.001 Social Media Accounts

## Sources

- [Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation](https://unit42.paloaltonetworks.com/vidar-stealer-xmrig-miner-campaign-analysis/)
- [Vidar Infostealer Hammers SMBs via Malvertising Campaign](https://www.darkreading.com/cyberattacks-data-breaches/vidar-infostealer-smb-malvertising-campaign)
- [New Malicious Campaign Delivers Vidar Stealer and Monero Crypto Miner](https://www.infosecurity-magazine.com/news/new-campaign-vidar-stealer-monero/)
- [Vidar Malware Campaign Uses Fake Software Downloads to Steal Credentials and Mine Cryptocurrency](https://securityboulevard.com/2026/07/vidar-malware-campaign-uses-fake-software-downloads-to-steal-credentials-and-mine-cryptocurrency/)
- [Brinztech Alert: Analysis of Dual-Payload Vidar/XMRig Malvertising Campaign](https://www.brinztech.com/breach-alerts/brinztech-alert-analysis-of-dual-payload-vidar-xmrig-malvertising-campaign)
- [Unit 42 Researchers exposed a new Vidar campaign using a loader-as-a-service framework, DLL sideloading with a Go-compiled fake MpClient.dll](https://malwaretips.com/threads/unit-42-researchers-exposed-a-new-vidar-campaign-using-a-loader-as-a-service-framework-dll-sideloading-with-a-go-compiled-fake-mpclient-dll.142161/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1183