A new cyber-attack campaign has been identified that targets consumers and small to medium-sized businesses globally, using malicious methods to steal cryptocurrency data and mine Monero. First discovered by Unit 42 in April 2026, attackers use malvertising to lead victims to download fake software, leveraging password-protected archives to evade detection.
The campaign employs anti-analysis techniques, featuring the Vidar infostealer to extract sensitive information and the XMRig cryptocurrency miner to hijack victim computer resources. The campaign is noted for its dual-monetization strategy, selling stolen data on criminal markets while extracting passive income through mining. The attackers communicate via Telegram and use advanced malware frameworks for deployment.