Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation

This campaign delivers Vidar stealer and XMRig miner through malvertising by distributing password-protected archives that impersonate cracked software. The malware uses Go-compiled loaders created with the Factory-v3 framework and employs advanced evasion techniques including the use of rogue Authenticode certificates mimicking JustWatch and BleacherReport, file inflation with null bytes, and AMSI bypass. Vidar stealer exfiltrates sensitive data such as browser credentials, cookies, and cryptocurrency wallets to command and control servers. Concurrently, XMRig mines Monero cryptocurrency on infected hosts. Persistence mechanisms include registry modifications, scheduled tasks, and startup folder scripts. The adversary, operating under the name X3D MINER, targets victims mainly in the U.S. and EU, leveraging a dual monetization approach of credential theft and cryptojacking.

The campaign results in theft of sensitive user data including browser credentials, cookies, and cryptocurrency wallets, potentially leading to account compromise and financial loss. Additionally, infected systems are used to mine Monero cryptocurrency, which can degrade system performance and increase operational costs. The use of code signing abuse and evasion techniques complicates detection and mitigation efforts. Persistence mechanisms allow the malware to maintain long-term access on compromised systems.

No specific patch or vendor fix is available for this malware campaign. Mitigation should focus on user education to avoid opening password-protected archives from untrusted sources, blocking malvertising channels, and employing endpoint detection solutions capable of identifying Go-based loaders, AMSI bypass techniques, and suspicious code signing certificates. Monitoring for unusual registry changes, scheduled tasks, and startup scripts can help detect persistence mechanisms. Refer to the vendor advisory and threat intelligence sources such as the Palo Alto Networks Unit 42 report for updated detection and response guidance.