Threats Tagged 'malvertising'

A financially motivated campaign identified in April 2026 distributes Vidar stealer and XMRig cryptocurrency miner globally via malvertising. The attackers use password-protected archives impersonating cracked software and Go-based loaders built with the Factory-v3 framework. The malware employs evasion techniques such as rogue Authenticode certificates, file inflation with null bytes, and AMSI bypass. Vidar stealer exfiltrates browser credentials, cookies, and cryptocurrency wallets, while XMRig mines Monero. Persistence is achieved through registry changes, scheduled tasks, and startup scripts. The threat actor, known as X3D MINER, targets victims primarily in the U.S. and European Union, combining credential theft and cryptojacking for dual monetization.

MediumMalwareUnited States#vidar stealer#cryptojacking#vidar

A previously undocumented Windows loader designated as OXLOADER delivers the CASTLESTEALER infostealer through malicious Google Ads campaigns, achieving remarkably low detection rates. The loader employs multiple obfuscation layers including control-flow flattening, opaque predicates, and mixed Boolean-Arithmetic techniques, along with self-modifying decryption stubs and abuse of the Windows .reloc section for shellcode staging. Distribution occurs via malvertising impersonating Node.js installations, redirecting victims through intermediary domains to Storj-hosted batch scripts. The loader implements five anti-VM and language checks, including CIS-region and Russian-language exclusions, suggesting a financially motivated Russian-speaking threat actor. OXLOADER uses DonutLoader to deliver the .NET-based CASTLESTEALER payload in memory, evading traditional detection mechanisms through deliberate engineering choices.

MediumMalwareUnited States#oxloader#donutloader#reloc section abuse

Cybercriminals orchestrated a sophisticated malvertising operation leveraging Google Ads to impersonate popular AI developer tools including Claude AI, ChatGPT Codex, Perplexity, Cursor IDE, and JetBrains. Over seven weeks spanning April to June 2026, attackers deployed 106 unique malicious hostnames across six distinct waves, initially hosting ClickFix social engineering pages on GitLab infrastructure before pivoting to weaponize claude.ai's legitimate shared chat feature. The campaign targeted technically proficient users searching for AI development tools, tricking them into executing terminal commands that deployed the MacSync infostealer. This credential-harvesting malware collected browser data, SSH keys, and cryptocurrency wallets. The Asia-Pacific region sustained the heaviest impact with 67.2% of over 2,000 victims, particularly concentrated in Taiwan. Anthropic responded by banning malicious accounts and implementing additional abuse mitigations.

MediumMalwareBritish Indian Ocean TerritoryFranceHong Kong+6#gitlab pages abuse#macsync#ai impersonation