XWorm RAT phishing-delivered persistence and exfiltration chain
Malware Activity
Summary
Hide ▲
Show ▼
The XWorm RAT infection chain used phishing emails and .XLAM attachments to run shellcode, inject code, and exfiltrate data to command-and-control servers. The activity matters because the payload combined reflective DLL injection and process injection to survive on infected systems and hide its execution. The malware traffic was tied to the XWorm family, indicating an active delivery path for a known remote-access threat.
Related Happenings
Webworm EchoCreep and GraphWorm backdoor expansion
Malware Activity
H score28
First: 20.05.2026 15:51
Last: 20.05.2026 15:51
Sources 1
About this happening:
Webworm expanded its malware arsenal in 2025 with the custom backdoors EchoCreep and GraphWorm, increasing its ability to run stealthy command-and-control oper...
Webworm EchoCreep and GraphWorm backdoor expansion
Malware ActivityAbout this happening: Webworm expanded its malware arsenal in 2025 with the custom backdoors EchoCreep and GraphWorm, increasing its ability to run stealthy command-and-control oper...
Formbook phishing campaign using DLL sideloading and obfuscated JavaScript
Campaign
H score30
First: 20.04.2026 18:01
Last: 20.04.2026 18:01
Sources 1
About this happening:
The Formbook phishing operation is targeting Windows organizations across Greece, Spain, Slovenia, Bosnia, Croatia and South America, using DLL sideloading and...
Formbook phishing campaign using DLL sideloading and obfuscated JavaScript
CampaignAbout this happening: The Formbook phishing operation is targeting Windows organizations across Greece, Spain, Slovenia, Bosnia, Croatia and South America, using DLL sideloading and...
Havoc Demon payload deployment and persistence operation
Malware Activity
H score22
First: 03.03.2026 19:15
Last: 03.03.2026 19:15
Sources 1
About this happening:
A fake IT support operation is deploying Havoc Demon payloads to preserve access across compromised endpoints and support likely data exfiltration or ransomware fo...
Havoc Demon payload deployment and persistence operation
Malware ActivityAbout this happening: A fake IT support operation is deploying Havoc Demon payloads to preserve access across compromised endpoints and support likely data exfiltration or ransomware fo...
ClickFix nslookup-delivered ModeloRAT activity
Malware Activity
H score24
First: 17.02.2026 19:03
Last: 17.02.2026 19:03
Sources 1
About this happening:
The ClickFix infection chain now uses nslookup to deliver ModeloRAT, increasing the chance that Windows users will self-infect and hand attackers remote control. T...
ClickFix nslookup-delivered ModeloRAT activity
Malware ActivityAbout this happening: The ClickFix infection chain now uses nslookup to deliver ModeloRAT, increasing the chance that Windows users will self-infect and hand attackers remote control. T...
LummaStealer infection surge via CastleLoader
Malware Activity
H score30
First: 11.02.2026 19:02
Last: 11.02.2026 19:02
Sources 1
About this happening:
The LummaStealer infostealer operation now includes a widespread ClickFix campaign observed in February 2026 that abuses Windows Terminal (wt.exe) instead of the R...
LummaStealer infection surge via CastleLoader
Malware ActivityAbout this happening: The LummaStealer infostealer operation now includes a widespread ClickFix campaign observed in February 2026 that abuses Windows Terminal (wt.exe) instead of the R...
Latest development: 06.03.2026 08:44
Microsoft disclosed a widespread ClickFix social-engineering campaign that uses Windows Terminal (wt.exe) instead of the Windows Run dialog to trick users into launching malicious commands, then chains through Terminal, PowerShell, cmd.exe, and MSBuild.exe to download payloads, set persistence via scheduled tasks, configure Microsoft Defender exclusions, and inject Lumma Stealer into chrome.exe and msedge.exe with QueueUserAPC().
Timeline
-
29.09.2025 11:52 2 articles · 9mo ago
XWorm RAT phishing delivery and persistence chain
Technical Analysis UpdateForcepoint described a multi-stage phishing chain on affected Windows hosts in which emails with .XLAM attachments execute shellcode, a secondary payload loads a .DLL file in memory, the second-stage DLL uses heavily obfuscated packing and encryption, reflective DLL injection loads another DLL, and the final malware performs process injection to maintain persistence and exfiltrate data to XWorm family command-and-control servers while a blank or corrupted Office file is used as a ruse.
Show sources
- Microsoft Flags AI-Driven Phishing: LLM-Crafted SVG Files Outsmart Email Security — thehackernews.com — 29.09.2025 11:52
- Microsoft Flags AI-Driven Phishing: LLM-Crafted SVG Files Outsmart Email Security — thehackernews.com — 29.09.2025 11:52