
A new cyberattack campaign is distributing malware that steals user information and mines cryptocurrency. The attackers are using the Vidar infostealer to harvest sensitive data and the XMRig miner to illicitly generate Monero coins.

Researchers have uncovered a sophisticated campaign distributing the Vidar stealer and XMRig cryptocurrency miner, primarily targeting users seeking cracked software. Attackers use malvertising to lure victims into downloading password-protected archives containing malicious loaders. These loaders are signed with a fake certificate and employ techniques like file-size inflation and AMSI bypass to evade detection before dropping the final payloads.