Factory-v3 Loaders Deliver Vidar and XMRig Through Malvertising
Summary
Unit 42 analyzed an April 2026 malvertising campaign using Factory-v3 loaders to deliver Vidar and XMRig via fake cracked software. It details oversized padded files, rogue signing certificates, an AMSI bypass, persistence, data theft and Monero mining.
Key points
- Unit 42 identified 43 initial loader samples and 56 additional variant samples, with activity reported mainly in the U.S. and EU.
- Malvertising directed people seeking cracked software to password-protected archives containing the loaders.
- Factory-v3 Go loaders used unique builds and null-byte padding; one sample reached 491 MB, while its malicious content was 2.3 MB.
- The investigation describes fake MpClient.dll files used for DLL search-order hijacking and a Vidar payload that patches AmsiScanBuffer.
- Loader signatures impersonated JustWatch and later Bleacher Report; the article says neither company was compromised and the certificates were untrusted.
- Vidar targeted browser credentials, cookies and cryptocurrency wallet data; XMRig mined Monero. The malware also used registry, scheduled-task and startup-folder persistence.
- Unit 42 recommends validating Authenticode chains, scanning files regardless of size, and monitoring for MpClient.dll loads from non-standard paths.
Article Details
- Attack Vectors
- Malvertising lured people searching for pirated or cracked software to fake download pages; the malware was delivered in password-protected .bin archives.
- Factory-v3 Go loaders used rogue Authenticode certificates impersonating JustWatch and, in a later variant, BleacherReport.
- Loaders were padded with hundreds of megabytes of null bytes to evade file-size limits in automated analysis environments.
- Fake MpClient.dll files used DLL search-order hijacking to load malicious code through a legitimate Windows Defender binary.
- The Vidar payload patched AmsiScanBuffer in memory, potentially disabling AMSI scanning.
- Vidar and XMRig payloads established persistence through a registry Run key, an on-logon scheduled task, and a Startup-folder batch script, all pointing to NisSrv.exe.
- Vidar collected browser credentials, cookies, and cryptocurrency wallet data and exfiltrated it to C2 infrastructure; XMRig used victim CPU resources to mine Monero.
- Telegram notifications alerted the operator to new infections and activity.
- Defensive Notes
- Enforce strong Authenticode chain validation and consider blocklisting the rogue certificate serial number.
- Configure security tooling to scan files regardless of size and remove null-byte padding before applying file-size limits.
- Monitor for MpClient.dll loading from non-standard paths.
- Hunt for the described persistence indicators and file-drop patterns.
- Block outbound connections to the reported C2 IP addresses and pool.supportxmr[.]com.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 116[.]203[.]243[.]208 | Reported as a Vidar C2 server in the later sample cluster. |
| IPV4 | 136[.]243[.]203[.]109 | Vidar C2 address used for exfiltrating stolen data. |
| IPV4 | 136[.]243[.]203[.]111 | Reported as a new C2 server in the later sample cluster. |
| IPV4 | 138[.]199[.]246[.]13 | Reported as a C2 server in the campaign infrastructure. |
| SHA1 | ab92f731ab20774dfdb95664ee41a2fbafe2a284 | SHA-1 fingerprint of a rogue code-signing certificate used by loader samples to impersonate JustWatch. |
| SHA256 | 5d7324d8b5a25f862ef8223c6766d0e80af3ad168e17312b265e13a3a68e0ded | SHA-256 of a Cluster B fake MpClient.dll loader sample. |
| SHA256 | 68ced9d7c1b1ff8ffb5f56c7d3f849d4fd16a1b95324426811424b40043d6d25 | SHA-256 of a Cluster A Go loader sample. |
| SHA256 | 7ed4a256e1d281cb4f194d13ff554fd4fb280dafde0a67a18115ea038ea6c87d | SHA-256 of the Vidar core payload sample listed for Cluster D. |
| SHA256 | 914c18a04a2727bba9cecab78a1d516ec3c7a3f667e0e5a6081aa0e9206a69fe | SHA-256 of a Cluster C x86 Go loader sample. |
| SHA256 | ca8a00c9d36c64e5dcf562c7ae2b8df4bd6455fe0b41b32ee3a2a528ddc2d155 | SHA-256 of a sample listed in the Variant B malware cluster. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe malware used XOR-obfuscated strings and data blobs, including encoded AMSI names and XMRig configuration data.T1036 · MasqueradingLoader filenames and rogue certificate identities mimicked legitimate software and publishers, including JustWatch and BleacherReport.T1041 · Exfiltration Over C2 ChannelVidar packaged stolen data into a ZIP and exfiltrated it to the reported C2 address.T1053.005 · Scheduled TaskThe malware created an on-logon scheduled task named SystemAgentService to run NisSrv.exe.T1057 · Process DiscoveryThe loader used process enumeration as an anti-analysis measure.T1071.001 · Web ProtocolsThe malware made an HTTP GET request for victim geolocation and communicated with C2 infrastructure.T1082 · System Information DiscoveryThe malware gathered hardware IDs and volume-serial-related identifiers from victims.T1105 · Ingress Tool TransferThe loader dropped and ran Vidar and XMRig payloads on the victim machine.T1112 · Modify RegistryThe payload modified the HKCU Run key, setting SystemAgentService to launch NisSrv.exe.T1204.002 · Malicious FileThe attack relied on victims extracting and executing a loader disguised as a cracked software download.T1496 · Resource HijackingXMRig used victim CPU resources to mine Monero.T1547.001 · Registry Run Keys / Startup FolderPersistence used a registry Run key and a Startup-folder batch script that pointed to the NisSrv.exe malware copy.T1562.001 · Disable or Modify ToolsThe Vidar core patched AmsiScanBuffer in memory to force E_INVALIDARG and potentially disable AMSI scanning.T1574.002 · DLL Side-LoadingMalicious MpClient.dll variants were placed in a higher-priority search path so a legitimate Windows Defender binary would load them.
Threat Actors
Malware
Lumma StealerThe same builder, toolchain and Authenticode certificate infrastructure underpin a concurrent Lumma stealer campaign.VidarIn April 2026, Unit 42 uncovered a malvertising-driven campaign that used fake cracked software downloads to deliver Vidar stealer and the XMRig miner to victims in the U.S., EU, and beyond.XMRigIn April 2026, Unit 42 uncovered a malvertising-driven campaign that used fake cracked software downloads to deliver Vidar stealer and the XMRig miner to victims in the U.S., EU, and beyond.
Products
TelegramThe campaign relied on Factory-v3 loaders, rogue code-signing certificates, AMSI bypasses, and persistence mechanisms to steal data, mine Monero, and notify operators through Telegram.Windows Defenderand fake JustWatch/BleacherReport certificates (‘mimic cracked versions’, ‘blend in with legitimate Windows Defender components’).