Cybercriminals are using fake invoice emails to spread XWorm, a dangerous remote-access trojan (RAT) that steals credentials, passwords, and sensitive files while giving attackers full control over infected systems.
How Does the Attack Work?
The campaign begins with a seemingly harmless email that looks like a routine payment notification. These emails often include:
- A polite message from someone claiming to be an account officer
- An attached Visual Basic Script (.vbs) file disguised as an invoice
When the victim opens the attachment, the malware executes silently in the background without any alerts, making detection extremely difficult.
Why Is XWorm So Dangerous?
Once active, XWorm:
- Records keystrokes
- Spies on user activity
- Steals personal data and login credentials
- Installs additional threats like ransomware
This gives attackers complete control over the infected machine.
The Clever Tactic Behind the Attack
Attackers exploit outdated technology—Visual Basic Script files—which most users no longer expect in business emails. Many email security systems block .vbs files, but if they slip through, the damage can be severe.
Technical Analysis
Malwarebytes researchers identified the malicious attachment as Backdoor.XWorm. XWorm operates as malware-as-a-service, meaning attackers can rent infrastructure to launch campaigns without deep technical skills.
Infection Chain
- Initial Stage:
- The .vbs file contains 429 lines of obfuscated code.
- Drops a batch file named IrisBud.bat into the Windows temp folder.
- Uses Windows Management Instrumentation (WMI) to execute invisibly.
- Persistence:
- Batch file copies itself to the user profile directory as aoc.bat.
- Runs minimized and hidden from the user.
- Obfuscation Techniques:
- Dummy variables and padding to confuse analysis tools.
- Hidden payload sections disguised as comments (::).
- Final Stage:
- PowerShell script decrypts AES-encrypted payloads.
- Decompresses data with GZip.
- Loads executables directly into memory (fileless execution) to evade antivirus detection.
Sandbox analysis revealed a mutex identifier 5wyy00gGpG6LF3m6, confirming the XWorm malware family.
Why This Matters
- Fileless execution makes detection harder.
- Malware-as-a-service lowers the barrier for attackers.
- Email-based delivery targets both individuals and organizations.
How to Protect Against XWorm
- Block .vbs attachments at the email gateway.
- Use advanced threat detection for fileless malware.
- Train employees to spot phishing and suspicious invoices.
- Keep endpoint protection and PowerShell policies updated.
FAQ
Is XWorm ransomware?
No, it’s a RAT, but it can install ransomware later.
Can antivirus detect XWorm?
Traditional antivirus struggles due to fileless execution. Use EDR solutions.
Who is at risk?
Any organization using email for invoicing and payment notifications.
