Loading story…
Attackers are distributing malicious Visual Basic Script (.vbs) files via email attachments disguised as payment confirmations or invoices. When executed, these scripts use obfuscation techniques and staged execution to evade detection and ultimately deliver remote access trojans (RATs) such as Formbook and XWorm. The infection chain typically begins with a ZIP archive containing the VBS file, which, once run, reconstructs and executes further payloads using PowerShell, leveraging string concatenation and delay loops to bypass security controls.
The delivered malware provides attackers with extensive capabilities, including file theft, credential harvesting, keystroke logging, surveillance, and the ability to deploy additional threats like ransomware. These campaigns exploit social engineering by mimicking legitimate business communications and rely on outdated scripting formats to bypass user suspicion and some security tools. Both Formbook and XWorm are distributed as malware-as-a-service, enabling widespread use by various threat actors.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
Malwarebytes published research on a malicious fake invoice lure that led to an XWorm-related infection chain, revealing technical details of the campaign. No separate incident date is stated in the content, so the publication date is used.
SANS Internet Storm Center published an analysis describing a Formbook malware infection chain delivered through multiple scripts. The reference indicates technical details of the delivery method were disclosed, but no earlier event date is provided in the content.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors have launched a sophisticated phishing campaign that leverages fake invoice emails to distribute the XWorm Remote Access Trojan (RAT) to Windows systems. The attack begins with emails purporting to be about pending invoices, often using subject lines such as “Facturas pendientes de pago” and sender names like Brezo Sánchez to appear legitimate. These emails contain malicious Office file attachments, typically with .xlam or .bin extensions, which are designed to appear either blank or corrupted to the recipient. Upon opening the attachment, a hidden component within the file, identified as oleObject1.bin, executes encrypted shellcode. This shellcode initiates a download from a remote server, specifically hxxp://alpinreisan1com/UXOexe, retrieving the main malicious executable, UXO.exe. The executable then loads a second-stage DLL, DriverFixPro.dll, directly into the system’s memory using reflective DLL injection, a technique that avoids writing the file to disk and helps evade detection by security software. The injected DLL performs process injection, allowing the XWorm RAT to run within the context of a legitimate process, further enhancing its stealth. Once active, XWorm RAT provides attackers with extensive control over the compromised system, enabling keystroke logging, remote desktop access, data exfiltration, and persistent access. Researchers from Forcepoint X-Labs have highlighted the campaign’s technical sophistication and the widespread use of XWorm RAT, which has reportedly infected over 18,000 devices globally. The campaign’s use of Amazon Web Services S3 storage in earlier attacks demonstrates the attackers’ adaptability and resourcefulness. Security experts warn organizations to be particularly cautious of unexpected invoice emails and to scrutinize attachments with uncommon file extensions. Maintaining up-to-date software and employing advanced email filtering are recommended to mitigate the risk. The campaign underscores the ongoing evolution of phishing tactics and the persistent threat posed by remote access trojans like XWorm.
Jun 29, 2026
Multiple active malware campaigns are delivering **remote access trojans (RATs)** using deceptive lures and multi-stage execution chains designed to evade endpoint defenses. Malwarebytes reported a campaign dubbed **DEAD#VAX** that distributes a file masquerading as a “PDF” but actually delivered as a **virtual hard disk (`.vhd`)** hosted via **IPFS**; when opened, Windows mounts the VHD and the victim is tricked into launching a **Windows Script File (`.wsf`)** that ultimately deploys **AsyncRAT**. The chain includes anti-analysis checks and **process injection** into Microsoft-signed binaries such as `RuntimeBroker.exe`, `OneDrive.exe`, `taskhostw.exe`, and `sihost.exe`, enabling hands-on-keyboard remote control while minimizing obvious on-disk artifacts. Separately, reporting described **DesckVB RAT v2.9**, a modular **.NET** RAT using an obfuscated **WSH JavaScript** stager followed by **PowerShell**-based anti-analysis checks and an in-memory (“fileless”) loader, emphasizing persistence and a plugin-based architecture for post-compromise capabilities. Another campaign distributes **ValleyRAT** disguised as a legitimate *LINE* installer, targeting **Chinese-speaking users**; it attempts to weaken defenses by using PowerShell to add broad **Windows Defender exclusions**, performs sandbox checks (e.g., mutex/file-locking behaviors), and uses advanced injection (reported as **PoolParty Variant 7** via Windows I/O completion ports) to hide within trusted processes while stealing credentials and maintaining C2 communications.
Jun 29, 2026Multiple active malware delivery campaigns are using social engineering and trusted-looking artifacts to install **remote access trojans (RATs)**. One campaign impersonates the popular Chinese antivirus *Huorong Security* via a typosquatted domain `huoronga[.]com`, routing downloads through an intermediary domain and serving a trojanized NSIS installer from Cloudflare R2; the payload is **ValleyRAT**, described as built on the **Winos4.0** framework and attributed to the Chinese-speaking **Silver Fox** threat group. The infection chain is designed to look legitimate end-to-end (convincing website, normal installer UX) while deploying a full-featured backdoor with stealth and injection capabilities. Separately, email-borne campaigns are abusing attachments and “benign” file types to smuggle malware. Fortinet-reported activity uses phishing lures (e.g., payment or bank-document themes) with Excel attachments exploiting `CVE-2018-0802` to launch scripts that download a JPEG containing embedded **XWorm 7.2**, then uses **process hollowing** (e.g., into `Msbuild.exe`) and connects to a C2 at `berlin101.com` over port `6000` with AES encryption. SANS ISC also documented a similar “malicious JPEG” technique observed in the wild, where a large, heavily obfuscated JScript attachment (delivered in a GZIP wrapper) attempts persistence by copying itself to the Startup folder and participates in a chain that ultimately leverages payloads embedded in JPEGs; the message spoofing failed DMARC/SPF checks, which would likely lead to quarantine in many environments.
Jun 29, 2026