$100k in Crypto Drained by the Underground Operation

Reported 02 Oct 2026 by otx · Severity: medium

A cryptocurrency-stealing operation utilizing an Aotera/Tedy loader injects a Vidar-class stealer into Windows processes, launching Chrome or Edge to inject malicious scripts into victim sessions. The malware builder, dubbed Underground, has been active since October 2023. The op