Tool
Factory-v3
- First Reported
- Jul 8, 2026
- Latest Reported
- Jul 16, 2026
Reported Context (2)
- XMRig mines Monero cryptocurrency.” The loader binaries use the Factory-v3 framework, which refers to a malware-as-a-service (MaaS0 builder used for different families of stealer malware. This Week’s Threats Include Game-Cheat Spyware, Spirals Ransomware and Chrome Sync Abuse
- The campaign relied on Factory-v3 loaders, rogue code-signing certificates, AMSI bypasses, and persistence mechanisms to steal data, mine Monero, and notify operators through Telegram. Factory-v3 Loaders Deliver Vidar and XMRig Through Malvertising
CVE (3)
Malware (12)
People (1)
Threat Actors (7)
MITRE ATT&CK (23)
Vendors (11)
Products (17)
Tools (5)
Industries (2)
Countries (11)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.