Vidar Infostealer Hammers SMBs via Malvertising Campaign

Unit 42 uncovered a malvertising campaign that lures users to attacker-controlled sites offering cracked software; downloaded password-protected archives execute a Go-based Factory-v3 loader that employs AMSI bypasses, fake code-signing, and large-file padding to evade detection, then drops the Vidar infostealer (harvesting browser credentials, cookies, crypto wallets, etc.) and the XMRig Monero miner, establishes persistence via Run keys and scheduled tasks, and includes IoCs for defenders to block C2 and mining pools.