A financially motivated campaign active in April 2026 delivers Vidar stealer and XMRig cryptocurrency miner to victims worldwide via malvertising for fake software cracks. The campaign uses the Factory-v3 Go loader framework with per-build unique binaries, fabricated Authenticode certificates impersonating legitimate brands, file-size inflation up to 491 MB to evade sandbox analysis, and an in-memory AMSI bypass. Vidar exfiltrates browser credentials, cookies, and crypto wallets to C2 servers, while XMRig mines Monero using the pool.supportxmr.com mining pool. The operator receives Telegram notifications for each new infection.
Vidar Stealer
4 posts
Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation - 7 minWeekly Recap — 2026-06-08 -> 2026-06-15
Perimeter Auth Collapse and AI-Driven Deception Shift the Battlefield The security perimeter cracked open this week as critical authentication bypasses in Check Point VPNs, Ivanti Sentry, and Palo Alto GlobalProtect gave attackers a free pass into corporate networks, with Qilin ransomware already exploiting one to launch real attacks. At the same time, AI became the year's most versatile weapon: criminals used ChatGPT and Claude brands as phishing lures, researchers proved AI email assistants will hand over corporate secrets to impersonators, and the Shai-Hulud campaign began injecting fake prompts to blind AI-powered security scanners. Patch edge VPN appliances immediately, treat AI agents as high-risk insiders, and hunt for device-code authentication events that bypass normal credential checks.
AI brands as bait: How threat actors are using the AI hype in social engineering Threat actors are increasingly leveraging the hype around AI platforms like ChatGPT, Claude, and DeepSeek to conduct social engineering attacks. These campaigns utilize phishing, malvertising, and SEO poisoning to distribute infostealers such as Vidar or facilitate credential theft via adversary-in-the-middle (AiTM) infrastructure.
Weaponizing Trust Signals: Claude Code Lures and GitHub Release Payloads Following an accidental leak of Anthropic's Claude Code source material, threat actors rapidly deployed a social engineering campaign using fake GitHub repositories. The campaign distributes trojanized archives containing a Rust-compiled dropper that deploys Vidar stealer and GhostSocks proxy malware, specifically targeting developers seeking AI tools.
