Executive Summary
In April 2026, researchers identified a global campaign targeting consumers and small-to-medium businesses with a dual-monetization scheme involving information theft and cryptocurrency mining. Attributed to an affiliate of the Vidar stealer Malware-as-a-Service (MaaS) using the moniker X3D MINER, the campaign leverages malvertising for 'cracked' software to lure victims into downloading malicious Go-based loaders.
The attack chain utilizes the Factory-v3 (or UpdateFactory) builder to generate unique, file-inflated binaries that impersonate legitimate software through rogue Authenticode certificates. Once executed, the malware deploys Vidar stealer to exfiltrate browser credentials and crypto wallets, while simultaneously running XMRig to mine Monero. The campaign demonstrates high technical agility, transitioning between different forged certificates (e.g., justwatch[.]com to bleacherreport[.]com) and employing anti-analysis techniques like AMSI patching and DLL search-order hijacking.
This activity is significant due to its effective evasion of automated sandboxes via null-byte padding (inflating files up to 491 MB) and its use of compromised brand reputation to bypass user suspicion. Organizations should be wary of unauthorized software downloads and monitor for specific persistence mechanisms in %AppData% and %TEMP% directories.