XWorm campaigns used AMSI bypasses and linked malware delivery to carding operations

Researchers detailed two XWorm delivery operations that relied on multi-stage loaders, in-memory execution, and AMSI bypasses to evade detection. In one campaign attributed to TAG-124, compromised legitimate websites redirected selected victims into a PowerShell chain that patched clr.dll to disable AmsiScanBuffer, suppressed PowerShell history, disabled ETW, fingerprinted hosts, and pulled an XOR-encrypted payload from sellmeyourbiz[.]com, ultimately delivering XWorm RAT. Breakglass reported low initial detection rates and observed victim-specific beaconing under /customers/, with encoded host details including hostname, domain, username, process ID, campaign ID, and hardware UUID.

A separate three-stage intrusion used a VBScript lure, Projet20Immobilier.vbs, masquerading as a French real-estate document to deploy XWorm V5.6 through a .NET loader and process injection into InstallUtil.exe. Breakglass assessed the operator was likely Brazilian based on Portuguese-language code artifacts and found the same infrastructure also hosted a Portuguese carding marketplace, Iluminat Store infosCC, suggesting a vertically integrated criminal pipeline that steals credentials and payment data with XWorm and monetizes them directly through fraud services. The malware infrastructure included servers on DigitalOcean and Contabo, and the sample used the default XWorm encryption key <123456789>, exposing weak operator OPSEC despite capabilities that included keylogging, screenshot capture, DNS hijacking, persistence, and ransomware plugin support.