Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation

Summary: In April 2026, Unit 42 researchers identified a financially motivated campaign delivering Vidar stealer and the XMRig Monero miner to consumer and SMB victims worldwide through malvertising pages impersonating cracked software. The 43 loader binaries found initially were signed with a fabricated Authenticode certificate mimicking JustWatch GmbH, built with the Factory-v3 MaaS framework, and padded with null bytes to reach 491 MB against a real payload of 2.3 MB.

What's compelling: Most sandboxes skip files above 50-100 MB, so a 491 MB sample whose actual malicious content is 2.3 MB never executes in the analysis environment at all. The same Factory-v3 builder and certificate infrastructure also underpin a concurrent Lumma stealer campaign, meaning one upstream service is arming at least two distinct affiliates.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related