Since early 2020, more than 250 domains have been used in a widespread impersonation campaign aimed at disseminating the information-stealing malware Vidar and Raccoon.