The Loud and the Silent: How Factory-v3 Loaders Deploy Vidar and XMRig as a Dual-Monetization Payload
Executive Summary
A coordinated, high-volume malware campaign documented by Palo Alto Networks Unit 42 on July 8, 2026 is deploying paired payloads — Vidar Stealer version 2.0 and the XMRig Monero miner — through a Go-compiled loader framework designated Factory-v3. The campaign reaches endpoints through two primary delivery channels: search engine malvertising impersonating cracked software downloads, and compromised high-subscriber YouTube channels with pinned malicious file links.
The loader employs multiple evasion techniques simultaneously: password-protected archives with non-standard extensions to bypass gateway inspection, binaries padded with up to one gigabyte of null bytes to exceed sandbox processing limits, in-memory patching of the Windows AmsiScanBuffer function to disable the Anti-Malware Scan Interface, and fraudulent code-signing certificates spoofing legitimate organizations including JustWatch GmbH. Once executed, Vidar silently extracts browser credentials, session cookies, and cryptocurrency wallet data while XMRig consumes CPU resources to mine Monero. Stolen session cookies reach underground log markets within hours of compromise, enabling access brokers to bypass multi-factor authentication before the victim organization detects the breach.
Immediate actionable guidance: Enforce execution blocks for binaries launched from user temporary directories and implement AMSI integrity monitoring to detect in-memory patching attempts as an immediate critical indicator.
Key Finding: Factory-v3 loaders deliver Vidar Stealer and XMRig miner as concurrent payloads, creating a dual-alert environment in which a high-CPU cryptomining alert — typically treated as low priority — may simultaneously be the cover condition for ongoing silent credential exfiltration and session cookie theft that reaches underground markets within hours of compromise.
What Happened
Palo Alto Networks Unit 42 published detailed technical analysis on July 8, 2026 documenting a coordinated campaign deploying the Factory-v3 Go-compiled loader framework to deliver Vidar Stealer and XMRig CoinMiner as simultaneous payloads to compromised Windows endpoints. The campaign had been expanding through mid-to-late Q2 2026, with the "X3D MINER" campaign tag appearing in Telegram-based affiliate notification infrastructure used by the threat operators. Factory-v3 is a Go-language malware builder producing loader binaries with consistent metadata characteristics across the affiliate ecosystem — Go-compiled binaries are cross-compilable, produce large binaries whose size can be further inflated for sandbox evasion, and add obfuscation complexity relative to conventional C or C++ compiled malware.
The campaign operates through two documented delivery channels. The first is malvertising: search engine advertisements appearing in response to queries for cracked or pirated commercial software, directing users to download pages that serve the malicious payload. The second is more structurally sophisticated: compromised YouTube channels with subscriber counts in the millions, where threat operators have gained control of the account and pinned video descriptions or comments linking to the malicious payload. The scale of subscriber counts provides search ranking legitimacy and a volume of potential victims that malvertising alone does not reliably achieve.
The payload delivery chain begins with a password-protected archive using a .bin or .rar extension — a deliberate choice that prevents automated gateway inspection tools from opening and scanning the archive contents. Once extracted, the user encounters a binary padded with hundreds of megabytes to as much as one gigabyte of null bytes — inert data inserted solely to inflate the file beyond the maximum size most automated sandbox environments process. Once executed, the loader applies an in-memory patch to the Windows AmsiScanBuffer function, preventing AMSI-integrated security tools from scanning subsequently loaded content. The loader also presents a fraudulent code-signing certificate spoofing JustWatch GmbH, a legitimate German streaming guide service whose identity was appropriated to make the binary appear signed by a known organization.
With defenses suppressed, Factory-v3 deploys two payloads. Vidar Stealer version 2.0 extracts stored credentials from modern web browsers, active session cookies, cryptocurrency wallet files, and autofill data. Browser session cookies are particularly high-value targets because they can be replayed to authenticate to web applications without re-entering credentials and without triggering multi-factor authentication prompts — the MFA challenge has already been completed by the legitimate user whose session is being cloned. Exfiltrated data is transmitted to command-and-control infrastructure routing through Telegram layers with a hardcoded IP node at 136.243.203[.]109. Concurrently, XMRig deploys and begins mining Monero using the endpoint's CPU. The Laplas Clipper, a clipboard-hijacking tool that substitutes cryptocurrency wallet addresses in clipboard content, has also been observed in select Factory-v3 deployments, adding a third monetization mechanism.
Why It Matters
For Security Practitioners & SOC Teams
The combination of Vidar and XMRig in a single deployment creates a deliberate detection asymmetry. XMRig's CPU utilization is immediately and measurably visible: sustained high CPU usage generates help desk tickets, hardware anomaly alerts, and user complaints. Vidar's credential extraction, by contrast, is designed to be silent and brief — it completes its harvest quickly, exfiltrates the data, and does not persistently burden system resources. The operational consequence for SOC teams is specific: a high-CPU alert classified as low-severity adware or potentially unwanted program activity — the conventional disposition for coin miner detections — may be simultaneously masking an active credential exfiltration event that is already complete by the time the alert is reviewed. Detection workflows that defer miner alerts to lower-priority queues should be reassessed immediately. Any miner detection should prompt parallel investigation of credential and session cookie exfiltration indicators on the same host within the same investigation window.
For Security Leaders & CISOs
The session cookie theft component has direct implications for identity architectures that rely on MFA as the primary control against unauthorized access. Session cookies represent a post-authentication artifact: the MFA challenge has already been passed by the legitimate user. A replayed session cookie bypasses MFA entirely because the web application treats the cookie as evidence of a previously completed authentication. Enterprise cloud environments, SaaS portals, and internal web applications that do not implement session binding controls are vulnerable to session replay with stolen cookies regardless of MFA policy. The use of compromised YouTube channels with multi-million subscriber counts as a distribution vehicle also represents a significant trust exploitation — standard security awareness training focused on unfamiliar or suspicious sources does not address this vector effectively.
For Policy, Risk & Compliance Officers
The downstream market for data harvested by Vidar operates on a compressed timeline with significant implications for breach response and notification obligations. Stolen session cookies and corporate credentials are documented to reach underground log markets and access broker channels within hours of the initial compromise event. Organizations that detect a Vidar infection after the fact face a scenario in which credential material may have already been purchased and used by secondary actors before the primary infection is identified. This compression of the breach timeline is material for incident response planning: the window between initial compromise and potential secondary exploitation is shorter than conventional response timelines assume. The HHS Cybersecurity Program's analyst note specifically documents vectors through which stolen session credentials are weaponized against regulated healthcare portals, with direct implications for PHI access exposure.
Operational Implications
Immediate (Days to Weeks): Any endpoint reporting sustained anomalous CPU utilization should be treated as a potential dual-payload deployment and investigated for concurrent credential exfiltration indicators — not dispositioned solely as a miner detection. Immediate investigative steps include examination of browser credential stores and session cookie databases for signs of access or modification, review of recently executed processes for Factory-v3 loader characteristics (large binary sizes, execution from Temp or AppData directories, Go runtime metadata), and correlation of outbound network connections against the documented C2 IP 136.243.203[.]109 and Telegram routing infrastructure. Block execution of binaries from user temporary directories (%TEMP%, %AppData%, %Downloads%) as an immediate compensating control.
Short-Term (Weeks to Months): Implement AMSI integrity monitoring as a detection capability. The AmsiScanBuffer memory patch applied by Factory-v3 loaders is a detectable modification: endpoint security tools capable of monitoring the integrity of in-memory function pointers can detect this patch as it is applied and generate an immediate high-priority alert. This detection is loader-agnostic — any malware that patches AMSI in memory will trigger the same alert regardless of the specific payload being loaded. Review secure email gateway and web proxy configurations for maximum file size handling: files passed through as a default exception specifically enable the null-byte inflation strategy built into Factory-v3.
Long-Term (Months to Years): Factory-v3 represents the industrialization of multi-payload malware delivery: a modular builder enabling MaaS affiliates with varying technical sophistication to deploy combined credential theft, cryptomining, and clipboard hijacking as a pre-configured package. Security programs that associate these evasion techniques with nation-state or advanced persistent threat actors should revise that assumption; these capabilities are now accessible at the commodity MaaS tier. Security architecture roadmaps should account for the convergence of stealer and miner payloads as a normalized delivery pattern rather than an anomaly.
Recommended Actions
Actions are organized by organizational security maturity. The execution block and AMSI monitoring steps apply across all tiers and should be treated as immediate baselines regardless of organizational size.
* Organizations with standard security tooling and general-purpose endpoint protection.
- 1 - Implement execution blocks for binaries and scripts launched from user temporary and download directories via Software Restriction Policies, AppLocker rules, or Microsoft Defender for Endpoint Attack Surface Reduction rules targeting %TEMP%, %AppData%, and %Downloads%.
- 2 - Update web filtering policies to block access to software crack sites, file-sharing mirrors, and direct downloads of password-protected archive files (.rar, .bin, .7z) from untrusted domains.
- 3 - Brief employees with remote or hybrid work arrangements on the specific risk of downloading software from any source — including familiar YouTube channels — to devices with any connectivity to corporate accounts, email, or VPN.
- 4 - Treat any coin miner detection as a trigger for parallel investigation of the same host for credential exfiltration indicators before dispositioning the alert as low-priority adware.
* Organizations with dedicated security functions, SIEM coverage, and structured incident response capability.
- 1 - Configure correlation rules that link miner detection alerts with concurrent stealer behavior indicators on the same host; miner alerts should not route solely to lower-priority hardware anomaly queues.
- 2 - Integrate AmsiScanBuffer integrity monitoring into endpoint detection coverage; verify that in-memory AMSI patching detection is enabled and generating alerts in the current deployment configuration.
- 3 - Review identity and access management policies for session lifetime controls and Conditional Access requirements; reduce maximum session token lifetime on cloud and SaaS applications to limit the usable window for replayed stolen cookies.
- 4 - Assess session security controls on enterprise web applications for session binding features tying sessions to device fingerprint, IP address range, or certificate to reduce the utility of replayed cookies regardless of MFA policy.
* Organizations with mature security programs, threat intelligence capacity, and underground monitoring capability.
- 1 - Integrate underground credential market monitoring into threat intelligence feeds to detect compromised organizational credentials and session cookies before secondary exploitation occurs.
- 2 - Develop behavioral profiling baselines for Factory-v3 loader characteristics independent of specific file hashes: Go runtime binary metadata patterns, null-byte padding detection, AMSI patch attempts, and XMRig mining pool communications paired with outbound Telegram API connections.
- 3 - Conduct a session security architecture review across all enterprise web applications and cloud infrastructure portals with particular attention to whether stolen browser cookies provide sufficient replay capability to bypass current authentication controls.
- 4 - Configure continuous access evaluation that revokes sessions based on risk signals independent of the session cookie's validity period across all cloud and SaaS applications where the feature is available.
Closing Statement
The Factory-v3 campaign is not a novel technical achievement — its individual components are well-documented tools used across the commodity malware ecosystem for years. What distinguishes this campaign is its operational design: the deliberate pairing of a silent extractor with a noisy consumer, creating a detection environment where the visible threat is the less urgent one and the urgent threat is designed to be invisible until the damage is done.
That design reflects adversarial awareness of how enterprise SOC workflows are structured — what gets triaged first, what gets deferred, and where the gap is between an alert and a response. Bridging the awareness gap in this context means recognizing that commodity malware has industrialized the same evasion and dual-monetization techniques once exclusive to targeted campaigns, and that detection and response architectures built for the prior threat model may not be calibrated for the current one.