Vidar Stealer Campaign Uses Code‑Signing Abuse and Go Loaders to Harvest Credentials and Deploy XMRig Miner
What Happened – In April 2026, Palo Alto Networks’ Unit 42 uncovered a financially‑motivated campaign that distributes the Vidar credential‑stealer and the XMRig cryptocurrency miner via malicious‑advertising (malvertising). The loaders are signed with stolen code‑signing certificates, delivered in password‑protected .bin archives, and target consumers as well as small‑ and medium‑size businesses worldwide.
Why It Matters for Compliance & Audit Readiness
- The incident exemplifies a failure of access‑control safeguards: stolen code‑signing certificates bypass application‑whitelisting and allow unsigned code to run with a trusted appearance.
- SOC 2 Security and Confidentiality criteria require documented controls for credential protection, code‑signing governance, and malware‑detection – all of which must be continuously monitored and evidenced.
- Verisq’s SOC2 Access Controls capability helps map these gaps to the relevant Trust Services Criteria, collect continuous evidence (e.g., code‑signing certificate lifecycle logs), and produce audit‑ready reports.
Who Is Affected – Consumer‑focused software distributors, SMBs across all verticals, and any organization that permits user‑downloaded executables without strict code‑signing validation.
Recommended Actions
- Review and tighten code‑signing certificate issuance and revocation processes; enforce multi‑factor approval for any new certificate.
- Deploy endpoint detection that flags execution of binaries with mismatched or revoked signatures.
- Update security awareness training to cover malvertising tactics and the risks of downloading cracked software.
- Map the incident to SOC 2 controls CC6.1 (Logical access), CC6.2 (Authentication), and CC7.1 (System operations) and collect supporting logs as audit evidence.
Source: Palo Alto Unit 42 – Vidar Stealer Unmasked
Technical Notes – The loaders are written in Go, use DLL sideloading, and are signed with compromised certificates to evade AMSI and sandbox detection. The payload drops Vidar (browser credentials, cookies, crypto‑wallet files) and XMRig (Monero mining). No CVE is directly cited; the attack leverages code‑signing abuse and malvertising as the primary vector.