Overview of the Vidar Stealer and XMRig Campaign
Runtime Rebel analysts have identified a financially motivated campaign actively distributing the Vidar stealer and XMRig cryptocurrency miner to consumers and small- and medium-sized businesses (SMBs) worldwide. This campaign, observed with a notable spike in activity in mid-to-late April 2026, primarily targets organizations within the U.S. and European Union, according to Unit 42 researchers at Palo Alto Networks. Attackers use malvertising to lure victims to pages offering what appear to be cracked versions of copyright-protected software. Upon execution, a sophisticated loader deploys both the Vidar stealer, which targets browser credentials, cookies, and cryptocurrency wallets, and the XMRig miner, which mines Monero cryptocurrency.
This operation is attributed to an affiliate leveraging the Vidar stealer malware-as-a-service (MaaS) model. The primary threat lies in the direct compromise of sensitive user data and the surreptitious resource consumption for cryptocurrency mining, impacting financial security and system performance.
Technical Analysis of Delivery and Evasion Techniques
The campaign’s distribution mechanism relies on malvertising, leading victims to download malicious binaries disguised as pirated software. These malware payloads are often delivered within password-protected archives with a .bin extension. This tactic appears deliberate, aiming to bypass email gateway scanning and prevent automated sandbox detonation, as the password is required for extraction.
Sophisticated Go Loader and Anti-Forensic Measures
The initial loader binaries, identified as utilizing the Factory-v3 framework, exhibit several anti-forensic capabilities:
- Code Signing Abuse: Loaders are signed with a fabricated Authenticode certificate impersonating JustWatch GmbH, a legitimate German streaming guide service. While Windows SmartScreen flags the untrusted certificate, the visual presence of a recognizable brand name often deceives victims into proceeding. JustWatch GmbH is not compromised; the certificate uses a self-signed root certificate authority not present in public trust stores.
- Unique Binaries: The Factory-v3 builder generates a unique binary for each build, resulting in varying hashes across samples. This approach actively defeats hash-based detection methods, making traditional signature-based security insufficient.
- File Inflation for Sandbox Evasion: Many loader samples append hundreds of megabytes of null bytes after the last PE section, pushing file sizes up to 491 MB. This strategy aims to bypass common automated sandbox environments, which often enforce an upper file-size limit (e.g., 50-100 MB), causing oversized submissions to be silently skipped. The actual malicious content can be as small as 2.3 MB within these inflated files.
Advanced Evasion of Detection
The Vidar core payload incorporates several techniques to evade detection, which security professionals should be aware of. One significant feature is an in-memory Antimalware Scan Interface (AMSI) bypass. This routine loads amsi.dll, resolves the AmsiScanBuffer variable, and patches its initial six bytes. This patch forces the AmsiScanBuffer function to return E_INVALIDARG, potentially disabling Windows AMSI for all subsequent script and code execution on the compromised machine. Both the DLL name and function name are XOR-obfuscated with a single-byte key (0x05) to thwart static string scanning.
Furthermore, some loader variants (Cluster B DLLs) employ DLL search-order hijacking, a technique covered by MITRE ATT&CK® T1574.002. These variants export Windows Defender MpClient.dll API functions, ensuring that when a legitimate Windows Defender binary attempts to load MpClient.dll, the operating system prioritizes the malicious copy if placed in a higher-priority search path.
Actionable Recommendations and Mitigations
Organizations and individuals must implement layered security measures to defend against Vidar stealer and XMRig campaigns. Focusing on prevention and enhanced detection capabilities is critical to safeguard against these sophisticated threats.
- User Education: Emphasize user awareness training regarding the dangers of malvertising, pirated software, and suspicious downloads. Users should be educated on how to detect fake certificate warnings.
- Email and Gateway Security: Configure email gateways and security solutions to detect and quarantine password-protected archives, especially those with unusual extensions like
.bin. Enhance sandbox environments to handle large files, ensuring that null byte padding is removed before applying size limits for analysis. - Endpoint Detection and Response (EDR): Deploy EDR solutions capable of detecting and preventing in-memory AMSI bypasses and DLL search-order hijacking. Monitoring for unusual process behavior, such as a process creating connections to known cryptocurrency mining pools, can help identify XMRig activity.
- Network Monitoring: Monitor network traffic for connections to known XMRig mining pools or unusual outbound traffic patterns indicative of cryptocurrency mining. Implement egress filtering to block connections to unauthorized external IP addresses and domains.
- Regular Software Updates: Ensure all operating systems, applications, and security software are kept up-to-date with the latest patches to mitigate known vulnerabilities that could be exploited by such campaigns.
To effectively detect Vidar stealer and XMRig loader activity, organizations should focus on behavioral analysis rather than relying solely on hash-based or signature-based detection due to the unique binary generation and obfuscation techniques employed by the Factory-v3 builder. Implementing threat hunting practices to identify anomalies related to code signing, file sizes, and memory patching will strengthen defenses against these evolving threats.
Related: Smoke#Screen RMM Takeover Campaign Targets Enterprise Networks, Toshiba and Muji Impacted by Polyfill Supply Chain Attack