Loading story…
Researchers at Point Wild reported a malware campaign that abuses the legitimate packaging tool PyInstaller to disguise and deliver XWorm RAT v7.4 inside files presented as benign software or updates. The infection chain uses obfuscation and anti-analysis techniques, including a routine identified as _IAT_PHANTOM_FIX, then patches AMSI in memory to weaken Windows scanning before unpacking an encrypted payload. The malware is then dropped into %LOCALAPPDATA% as the hidden system file Win.Kernel_Svc_AJ8iOw.exe, helping it evade user notice and endpoint defenses.
Once installed, the payload connects to command-and-control infrastructure at 68.219.64.89:4444 using an AES key and enables a broad set of remote-access capabilities. Point Wild said XWorm can steal passwords, access files, activate webcams, launch DDoS attacks, and provide full remote control; researchers also observed deployment of an additional file, afacan313131.exe, as part of the intrusion. The findings show how attackers are combining trusted developer tools with memory patching and encrypted payload delivery to make a well-known malware family harder to detect.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
The researchers reported that the payload drops as a hidden file named "Win.Kernel_Svc_AJ8iOw.exe" in %LOCALAPPDATA% and connects to command-and-control server 68.219.64.89 on port 4444 using an AES key. They said the XWorm V7.4 infection enables password theft, file access, webcam spying, DDoS activity, and full remote control, including deployment of an additional file named afacan313131.exe.
Point Wild researchers uncovered a malware campaign that abuses the legitimate PyInstaller packaging tool to disguise and deliver XWorm RAT through deceptive emails or fake software updates. The attack chain uses obfuscation, anti-analysis routines, AMSI memory patching, and encrypted payload unpacking to evade detection.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that **XWorm**, a .NET-based Windows remote access trojan, has been both actively deployed in phishing attacks and marketed online as a builder for criminal operators. The malware has been advertised with modules for **RAT control, ransomware, HVNC, hidden RDP, DDoS, keylogging, credential theft, clipper functions, and persistence**, while incident analysis found live samples communicating with command-and-control servers such as `system6458[.]ddns[.]net` over port `6666`. Reverse engineering also showed that XWorm uses anti-analysis checks to terminate in virtualized or sandboxed environments and can persist through startup-folder copies, scheduled tasks, AppData placement, and registry autorun entries. Separate investigations tied XWorm to ongoing delivery campaigns, including the **MEME#4CHAN** phishing operation, which used fake hotel reservation lures and Microsoft Word documents exploiting `CVE-2022-30190` to launch multi-stage infection chains involving PowerShell, JScript, and in-memory .NET loading. Analysts found XWorm variants capable of **PowerShell execution, in-memory .NET execution, screenshots, plugin retrieval, USB spreading, uninstall functions, and DDoS**, with configuration fields such as `Host`, `Port`, and `KEY` encrypted using AES and derived keys. In some intrusions, the malware disabled **AMSI**, weakened Microsoft Defender, created a local administrator account named **System32**, disabled the Windows Firewall, and injected the final payload into processes including `RegSvcs.exe` and `Msbuild.exe`, with observed C2 infrastructure including `212.87.204[.]83:3000` and `port3000newspm.duckdns[.]org`.
Aug 15, 2026
Researchers documented several malware campaigns that used fake software and trojanized packages to deliver credential theft and remote-access payloads. On Windows, a fake *Resident Evil 9* mod from GitHub triggered a `curl | cmd` chain that deployed hidden batch, JavaScript, portable Node.js, portable Python, and an in-memory Go payload with browser theft, wallet targeting, hVNC-style control, webcam-related code, and exfiltration via Wormhole/B2 and Gofile; a separate fake AI video player installer led through Python bytecode, shellcode, and protected .NET loaders to **PureRAT**, which persisted through the `Run` key and communicated over authenticated WebSockets with `agent.sm-veo.com`. Another Windows campaign, dubbed **Operation TURB00**, used a Go loader and decoy console program to launch **Vidar** in memory, steal browser and application data, and install persistence through `agt.dll` and the `CadenceOptimizer` service running under `svchost` as `LocalSystem`. On macOS, analysts reversed a fully undetected **Atomic macOS Stealer (AMOS)** sample distributed as a signed DMG, bypassed its anti-VM checks, and recovered an AppleScript payload that stole browser data, wallet files, Telegram Desktop data, documents, and system information before exfiltrating to `95.164.53.3/contact`. In the software supply chain, a malicious PyPI package, `nhmpy 2.4.7`, masqueraded as NumPy while using a `.pth` file and an obfuscated JavaScript payload executed through Bun to harvest developer, cloud, CI/CD, registry, SSH, wallet, messaging, VPN, and AI-assistant secrets; it then spread using stolen GitHub tokens and malicious GitHub Actions workflows. Separately, a public Windows local privilege escalation exploit named **REDSUN** showed how attackers could turn standard-user access into `NT AUTHORITY\SYSTEM` by abusing a TOCTOU flaw involving NTFS and the Cloud Files API, creating a potential post-compromise path for malware already running on a host.
Jul 12, 2026
Researchers reported a malware campaign that abuses the legitimate Windows Error Reporting binary **`WerFault.exe`** to stealthily deploy **Pupy RAT** through DLL sideloading. The infection chain begins with a phishing email carrying an ISO attachment that contains `WerFault.exe`, a malicious **`faultrep.dll`**, a decoy **XLS** file, and a shortcut file that launches the payload via **`scriptrunner.exe`** and `cmd`. Because `WerFault.exe` is a Microsoft-signed binary, the technique helps the malware blend in with normal system activity and reduce suspicion from security tools. Analysis showed the malicious DLL uses a custom API resolver, spawns threads to open the lure spreadsheet, decrypts an embedded overlay with **RC4** using **`SystemFunction032`**, and loads the decrypted PE directly into memory as **Pupy RAT**. The RAT was observed attempting to reach a command-and-control server at **`103.79.76.40`**, although the server was offline during examination. Researchers said attribution remains unconfirmed, but the Chinese-language lure and other indicators suggest the operators may be China-based or targeting victims in China; the use of Pupy RAT also raises concern because the open-source remote access trojan has previously been linked to espionage activity and enables full device compromise.
Aug 15, 2026