Threat actors have launched a coordinated malvertising campaign targeting small to midsize businesses (SMBs) globally, delivering a malware two-for-one combo that steals sensitive data and hijacks victims’ CPU cycles for cryptomining. The financially motivated operation, uncovered by Palo Alto Networks’ Unit 42 in April, uses lures of cracked or pirated software to deliver the Vidar infostealer and XMRig cryptominer.
The campaign’s effectiveness lies in its multifaceted delivery and evasion strategies, which point to an experienced affiliate of the Vidar malware-as-a-service (MaaS) operation. The attackers use a password-protected archive that impersonates a legitimate software installer, making it harder for security systems to detect the malicious payload. Once executed, the loader installs Vidar, which harvests browser credentials, cookies, and cryptocurrency wallet files, while simultaneously deploying XMRig to mine Monero in the background.
What makes this campaign stand out is its dual-monetization scheme, where criminals sell stolen credentials on dark markets and use XMRig for passive income. This approach allows threat actors to maximize the value of each successful infection and demonstrates the continued evolution of MaaS operations toward more efficient multistage attack chains.
The attackers’ use of the Factory-v3 framework for MaaS building also appears to be a side hustle, acting as an upstream service used by multiple stealer affiliates. This suggests that the operators are skilled in the art of malware development and distribution, making it increasingly difficult for security systems to detect their tactics.
An attack typically begins when someone clicks on a malicious online ad for pirated software, which redirects them to attacker-controlled websites hosting the password-protected archives. The loader leverages the Factory-v3 Go framework to generate unique binaries per build, evading hash-based detection and making it harder for security systems to identify the malware.
The loader also uses defense-evasion techniques, including an in-memory Antimalware Scan Interface (AMSI) bypass and padding with null bytes to evade automated analysis. Once executed, the loader establishes persistence through Windows Registry Run keys and scheduled tasks, ensuring that the malware survives system reboots.
SMBs should be particularly vigilant against this type of attack, as the evasion tactics appear “specifically tuned for SMB-grade defenses.” To fortify their defenses, organizations can implement robust security measures, such as email gateway scanning and automated sandbox detonation. They should also keep software up-to-date, use strong passwords, and be cautious when clicking on online ads.
Ultimately, this campaign serves as a reminder that financially motivated threat actors are increasingly combining multiple monetization strategies in a single infection to maximize their gains. By understanding the tactics and techniques used by these attackers, organizations can take proactive steps to defend against MaaS attacks and protect sensitive data from falling into the wrong hands.
Source: Dark Reading — 2026-07-08