Fake Colombian court notices deliver XWorm via hidden scripts
Arctic Wolf says Spanish legal lures drop VBScript or JavaScript that inject XWorm into RegAsm.exe.
64
- Mentions · 7d2
- Mentions · 30d2
- All mentions7
- First seenSep 8, 2026
- Last mentioned2d ago
Timeline
7 articles · newest firstXWorm loader reused in phishing against Colombia and the UK
The Colombian chain uses a .NET DLL whose hash matches a September UK case, but payloads and C2 differ.
58
Hackers Use Fake GTA 6 Downloads to Deploy RATs, Infostealers and Data-Wiping Malware
Huntress tracked fake GTA 6 downloads distributing NJRAT, DCRAT, Mercurial Grabber, and Chaos ransomware used as a wiper against gamers.
45
Fake GTA 6 Installer Steals Browser Passwords, Discord Tokens and Crypto Data From Gamers
Huntress found fake GTA 6 installer ISOs spreading NJRAT, DCRAT, Mercurial Grabber and a Chaos ransomware wiper that steals credentials.
47
Fake GTA 6 download delivers malware-packed bundle to impatient gamers
Huntress found malware disguised as a leaked GTA 6 download bundling NJRAT, DCRAT, an infostealer, and Chaos ransomware used as a wiper.
45
Grand Theft Auto VI hype leads to malware
Fake GTA6 ISO downloads spread via SEO poisoning, torrents, and forums deliver NJRAT, DCRAT, an infostealer, and wiper ransomware.
45
Hackers Spend Nearly $7 Million on Expired Domains to Redirect Traffic to Scams and Malware
Infoblox reports Sable Squirrel spent nearly $7 million on expired domains to redirect traffic to illegal sports streaming, gambling, and malware infrastructure.
55
Appears with
- njRATmalware · 5
- Huntressvendor · 3
- Grand Theft Auto VIproduct · 3
- Mercurial Grabbermalware · 3
- Rockstar Gamesvendor · 3
- Chaosmalware · 3
- njRATproduct · 2
- DCRatproduct · 2
- XWormmalware · 2
- Huntressorganization · 2
- RegAsm.exeproduct · 1
- RSG_UnityAppmalware · 1
- AsyncRATmalware · 1
- Fortinetorganization · 1
- Sable Squirrelthreat actor · 1
- Mercurial Grabberproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.