Loading story…
The ILOVEYOU or LoveLetter email worm spread rapidly through Windows PCs by arriving as an attachment named LOVE-LETTER-FOR-YOU.TXT.vbs with the subject line ILOVEYOU, then mailing itself to Microsoft Outlook contacts and propagating through mIRC. Security analysis from F-Secure said the Visual Basic Script malware modified the Windows registry for persistence, changed Internet Explorer settings, overwrote scripts, images, and audio files across local and remote drives, and downloaded a password-stealing trojan that exfiltrated cached Windows and RAS credentials through smtp.super.net.ph to mailme@super.net.ph.
Reporting tied the worm's suspected origin to the Philippines and focused on Filipino programmer Onel de Guzman, who was linked to the outbreak and later spoke publicly without expressing remorse, describing his actions in terms of a "license to hack." The case also highlighted legal shortcomings at the time: Philippine authorities moved to drop charges because existing law did not clearly criminalize the conduct, underscoring how one of the first major global email-worm incidents outpaced national cybercrime statutes even as it caused widespread disruption and data loss.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
Years after the outbreak, reporting described the alleged Love Bug author as expressing no apology or remorse for the damage caused by the worm. The interview served as a retrospective public response tied to the original incident.
A Filipino man linked to the Love Bug case gave a public interview discussing his activities and presenting himself as having a "license to hack." The interview marked a notable public statement from a figure associated with the worm's creation.
Reports indicated that authorities in the Philippines were set to drop charges related to the ILOVEYOU virus case, reflecting legal difficulties in prosecuting the incident under the country's laws at the time.
Technical analysis revealed the worm modified the Windows registry for persistence, changed Internet Explorer settings, and downloaded an additional trojan that stole cached Windows and RAS passwords. The stolen credentials were exfiltrated via email through smtp.super.net.ph to a mailbox associated with the campaign.
The LoveLetter, or ILOVEYOU, worm was discovered spreading widely in the wild, propagating through Microsoft Outlook with the subject line "ILOVEYOU" and a malicious VBS attachment. It also spread through mIRC and caused widespread file overwriting and data loss on infected systems.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
6 references tracked. Mallory keeps watching after this page renders.
theregister.co.uk
Open sourcenytimes.com
Open sourceweb.archive.org
Open sourceweb.archive.org
Open sourcef-secure.com
Open sourcezdnet.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Mydoom** e-mail worm, also tracked as **Novarg** and `W32/MyDoom`, spread at record speed across the internet, infecting hundreds of thousands of computers and generating millions of malicious messages in more than 200 countries. Security firms said the worm relied on social engineering rather than advanced exploitation, arriving as spoofed e-mails that appeared to be bounced or undelivered messages and carrying executable attachments disguised as harmless text or ZIP files. The outbreak was severe enough that the U.S. Department of Homeland Security activated its cyber alert system, while **Microsoft** and **SCO Group** each offered **$250,000** rewards for information leading to the author’s arrest. The worm also converted infected systems into denial-of-service bots. **Mydoom.A** was programmed to attack **SCO Group**, while **Mydoom.B** shifted its focus to **Microsoft** and additionally altered the Windows `Hosts` file to block access to antivirus vendors’ websites, complicating cleanup for victims. By early February, mail-filtering data showed the outbreak was beginning to fade after peaking in late January, and monitoring indicated the Microsoft-targeting variant caused little measurable disruption because it spread less widely than the original strain.
Jun 29, 2026
Researchers reported that **Valak** is a modular, enterprise-focused malware family spread through **reply-chain email hijacking** and malicious attachments or links, often using **password-protected ZIP files** to evade inspection. Campaigns targeted organizations across sectors including manufacturing, transportation, finance, insurance, health care, and energy, with infection chains commonly relying on Microsoft Word macros or JavaScript droppers that launched payloads through Windows LOLBins such as `regsvr32.exe` and `wscript` to load DLLs in memory and reduce detection. Multiple reports tied Valak to the broader **Gozi/Ursnif** ecosystem through overlapping infrastructure, delivery patterns, and follow-on activity. Analysts said Valak used compromised websites and PHP proxy scripts to fetch staged payloads and track spam delivery, while specialized plugins such as **EXCHGRABBER** and **CLIENTGRABBER** stole Exchange, Office, and email credentials from Credential Manager, autodiscover data, and the Windows registry. Related Gozi/Ursnif campaigns used hijacked email threads, Google Drive links, and password-protected archives before deploying additional tools including **Cobalt Strike**, **TVRat/TeamViewer**, and VNC-based modules, reinforcing the connection between credential theft, thread hijacking, and multi-stage enterprise intrusion activity.
Aug 15, 2026
Researchers detailed two XWorm delivery operations that relied on multi-stage loaders, in-memory execution, and **AMSI bypasses** to evade detection. In one campaign attributed to **TAG-124**, compromised legitimate websites redirected selected victims into a PowerShell chain that patched `clr.dll` to disable `AmsiScanBuffer`, suppressed PowerShell history, disabled ETW, fingerprinted hosts, and pulled an XOR-encrypted payload from `sellmeyourbiz[.]com`, ultimately delivering **XWorm RAT**. Breakglass reported low initial detection rates and observed victim-specific beaconing under `/customers/`, with encoded host details including hostname, domain, username, process ID, campaign ID, and hardware UUID. A separate three-stage intrusion used a VBScript lure, `Projet20Immobilier.vbs`, masquerading as a French real-estate document to deploy **XWorm V5.6** through a .NET loader and process injection into `InstallUtil.exe`. Breakglass assessed the operator was likely Brazilian based on Portuguese-language code artifacts and found the same infrastructure also hosted a Portuguese carding marketplace, **Iluminat Store infosCC**, suggesting a vertically integrated criminal pipeline that steals credentials and payment data with XWorm and monetizes them directly through fraud services. The malware infrastructure included servers on DigitalOcean and Contabo, and the sample used the default XWorm encryption key `<123456789>`, exposing weak operator OPSEC despite capabilities that included keylogging, screenshot capture, DNS hijacking, persistence, and ransomware plugin support.
Jun 29, 2026