Unit 42Published
Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation
By Bharath Nannaka, Pranay Kumar Chhaparwal
Excerpt
Executive Summary
In April 2026, Unit 42 researchers identified a financially motivated campaign delivering Vidar stealer and the XMRig cryptocurrency miner to consumer and small- and medium-sized business victims worldwide.
Attackers lure victims via malvertising to pages for downloading files that impersonate cracked versions of copyright-protected software. Upon execution, the loader drops and runs both Vidar stealer and XMRig. Vidar stealer targets information like browser credentials, cookies and crypto wallets. XMRig mine…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Unit 42 on unit42.paloaltonetworks.com.
Mentioned in the excerpt
More from Unit 4218
- Unit 42 - Latest Cyber Security ResearchUnit 42 · Published 16 Oct
- Unit 42 - Latest Cyber Security ResearchUnit 42 · Published 16 Oct
- Unit 42 - Latest Cyber Security ResearchUnit 42 · Published 16 Oct
- Unit 42 - Latest Cyber Security ResearchUnit 42 · Published 16 Oct
On the same topics
- StealC Is Back, and This Time It's a RATVaronis · Published 22 Oct
- Threat Group Cards: A Threat Actor EncyclopediaETDA Threat Group Cards · Added 25 Oct
- Warden Stealer: The Rapid Rise of an Infostealer with an Appetite for AI Agent DataGen Digital · Published 8 Oct
- Unmasking a Multi-Stage Loader: AutoIt Abuse Leading to Vidar Stealer Command-and-Control CommunicationLevelBlue · Published 7 May
