Loading story…
Threat actors have launched a sophisticated phishing campaign that leverages fake invoice emails to distribute the XWorm Remote Access Trojan (RAT) to Windows systems. The attack begins with emails purporting to be about pending invoices, often using subject lines such as “Facturas pendientes de pago” and sender names like Brezo Sánchez to appear legitimate. These emails contain malicious Office file attachments, typically with .xlam or .bin extensions, which are designed to appear either blank or corrupted to the recipient. Upon opening the attachment, a hidden component within the file, identified as oleObject1.bin, executes encrypted shellcode. This shellcode initiates a download from a remote server, specifically hxxp://alpinreisan1com/UXOexe, retrieving the main malicious executable, UXO.exe. The executable then loads a second-stage DLL, DriverFixPro.dll, directly into the system’s memory using reflective DLL injection, a technique that avoids writing the file to disk and helps evade detection by security software. The injected DLL performs process injection, allowing the XWorm RAT to run within the context of a legitimate process, further enhancing its stealth. Once active, XWorm RAT provides attackers with extensive control over the compromised system, enabling keystroke logging, remote desktop access, data exfiltration, and persistent access. Researchers from Forcepoint X-Labs have highlighted the campaign’s technical sophistication and the widespread use of XWorm RAT, which has reportedly infected over 18,000 devices globally. The campaign’s use of Amazon Web Services S3 storage in earlier attacks demonstrates the attackers’ adaptability and resourcefulness. Security experts warn organizations to be particularly cautious of unexpected invoice emails and to scrutinize attachments with uncommon file extensions. Maintaining up-to-date software and employing advanced email filtering are recommended to mitigate the risk. The campaign underscores the ongoing evolution of phishing tactics and the persistent threat posed by remote access trojans like XWorm.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Trellix published a research report examining how XWorm RAT is distributed and the tactics used in its delivery and operation. The disclosure represents a new technical analysis of XWorm activity not reflected in the existing timeline entries.
A phishing campaign impersonating an Ernst & Young invoice used a VBScript attachment to deliver XWorm 7.4 through a five-stage infection chain involving hidden PowerShell, steganographic image files, and reflective loading into RegAsm.exe. The report identified C2 infrastructure at evaultbuzzfix[.]com:6000 (158.94.210.122), hosting in the Seychelles, and assessed the operator as likely Portuguese-speaking.
ANY.RUN published a technical analysis describing an XWorm malware campaign aimed at businesses in Latin America. The reference indicates a distinct regional targeting pattern not captured in the existing timeline entries.
FortiGuard Labs published a deep-dive on a new XWorm malware campaign that used multiple themed phishing emails to deliver the remote access trojan. The report represents a distinct technical disclosure of campaign activity not reflected in the existing timeline entries.
Attackers launched a malware campaign using fake invoice-themed Microsoft Office documents to deliver the XWorm remote access trojan. The two references describe the same activity and do not provide a more specific start date or additional distinct developments.
A phishing campaign used emails with shortened links that downloaded a ZIP archive containing a malicious LNK file, which launched a batch script to fetch and execute an XWorm payload. Analysis identified the malware as XWorm v5.6 and revealed configuration details including C2 server cyberdon1[.]duckdns[.]org:1500, mutex 5b6qhQLrSgjM8zFs, USB drop filename system32.exe, and Telegram bot integration.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 19 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
8 references tracked. Mallory keeps watching after this page renders.
trellix.com
Open sourceintel.breakglass.tech
Open sourceany.run
Open sourcefortinet.com
Open sourcescworld.com
Open sourcehackread.com
Open sourcecontagiodump.blogspot.com
Open sourcekienmanowar.wordpress.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that **XWorm**, a .NET-based Windows remote access trojan, has been both actively deployed in phishing attacks and marketed online as a builder for criminal operators. The malware has been advertised with modules for **RAT control, ransomware, HVNC, hidden RDP, DDoS, keylogging, credential theft, clipper functions, and persistence**, while incident analysis found live samples communicating with command-and-control servers such as `system6458[.]ddns[.]net` over port `6666`. Reverse engineering also showed that XWorm uses anti-analysis checks to terminate in virtualized or sandboxed environments and can persist through startup-folder copies, scheduled tasks, AppData placement, and registry autorun entries. Separate investigations tied XWorm to ongoing delivery campaigns, including the **MEME#4CHAN** phishing operation, which used fake hotel reservation lures and Microsoft Word documents exploiting `CVE-2022-30190` to launch multi-stage infection chains involving PowerShell, JScript, and in-memory .NET loading. Analysts found XWorm variants capable of **PowerShell execution, in-memory .NET execution, screenshots, plugin retrieval, USB spreading, uninstall functions, and DDoS**, with configuration fields such as `Host`, `Port`, and `KEY` encrypted using AES and derived keys. In some intrusions, the malware disabled **AMSI**, weakened Microsoft Defender, created a local administrator account named **System32**, disabled the Windows Firewall, and injected the final payload into processes including `RegSvcs.exe` and `Msbuild.exe`, with observed C2 infrastructure including `212.87.204[.]83:3000` and `port3000newspm.duckdns[.]org`.
Aug 15, 2026
Multiple malware campaigns have recently targeted Windows users through a variety of social engineering tactics and deceptive file distribution methods. In Korea, attackers leveraged popular webhard file-sharing services to distribute the xRAT (QuasarRAT) remote access trojan disguised as adult games. Victims were enticed to download compressed files that appeared to be legitimate games, but actually contained sophisticated malware components designed to evade detection and establish persistence on compromised systems. Meanwhile, a separate campaign in Brazil saw the Astaroth banking trojan propagate via WhatsApp, where a worm-like component harvested contact lists and automatically sent malicious ZIP files to spread the infection further. This campaign combined Python-based propagation with traditional credential-stealing modules focused on financial fraud. Other notable campaigns included the use of fake WinRAR installers distributed through Chinese websites, which employed multi-stage payloads to select and deploy the most effective malware for each victim. Additionally, phishing attacks impersonating DocuSign lured users into downloading stealthy malware through access code-protected web pages, using obfuscated PowerShell commands and in-memory payload decryption to bypass security controls. These incidents highlight the increasing sophistication of malware delivery mechanisms, the use of trusted brands and platforms for social engineering, and the global reach of threat actors targeting Windows environments through both email and messaging applications.
Jun 29, 2026
A phishing campaign is using emails disguised as payment or money transfer confirmations to trick recipients into opening a malicious **XLS** attachment. The messages impersonate employees of a specific company in Korea and present the spreadsheet as a legitimate payment slip, using a financial transaction lure to increase the likelihood that targets will open the file. When opened, the attachment exploits **`CVE-2017-0199`** in Microsoft Office to retrieve a remote **HTA** payload. The HTA then uses **WMI `Win32_Process.Create()`** to launch an obfuscated PowerShell script that downloads a steganographic **PNG** file, extracts and decrypts an in-memory **.NET** loader from embedded Base64 data, and ultimately installs **Remcos RAT**. The malware gives attackers remote access, including command execution, keylogging, screen capture, file manipulation, and data exfiltration to command-and-control infrastructure.
Jul 13, 2026