Executive Summary
Researchers from Palo Alto Networks' Unit 42 have identified a sophisticated malvertising campaign targeting small to midsize businesses (SMBs) globally. The operation utilizes lures of cracked or pirated software to deliver a Go-based loader that drops a two-for-one malware combination: the Vidar infostealer and the XMRig Monero cryptominer. This dual-monetization strategy allows the threat actor to profit from both stolen credentials and hijacked CPU cycles.
The campaign is notable for its use of the Factory-v3 framework, which enables the generation of unique binary builds to bypass hash-based detection. The attack chain involves password-protected archives designed to evade automated sandbox analysis and email gateway scanning. Once executed, the loader employs advanced evasion techniques, including in-memory AMSI bypasses and file padding with null bytes to reach sizes up to 500MB, effectively bypassing many standard security tool limits.