Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation

In April 2026 Unit 42 identified a global financially motivated campaign using malvertising to distribute Factory-v3 Go-based loaders that deploy Vidar stealer and an XMRig Monero miner; the campaign uses fake Authenticode certificates, file-size inflation, an AMSI in-memory bypass, DLL sideloading and multiple persistence mechanisms, and includes extensive IoCs (IP addresses, file hashes, file paths and registry/task persistence indicators) and mitigation guidance.