Fake Colombian court notices deliver XWorm via hidden scripts
Arctic Wolf says Spanish legal lures drop VBScript or JavaScript that inject XWorm into RegAsm.exe.
64
- Mentions · 7d3
- Mentions · 30d7
- All mentions10
- First seenSep 3, 2026
- Last mentioned2d ago
Timeline
10 articles · newest firstXWorm loader reused in phishing against Colombia and the UK
The Colombian chain uses a .NET DLL whose hash matches a September UK case, but payloads and C2 differ.
58
Storm-1865 used ClickFix and Booking.com lures against hotels
Fake CAPTCHA pages pushed mshta commands that installed stealers and RATs; Booking.com says its own systems were not breached.
36
In Other News: ICS-Sniper Attack, Hacking XWorm Malware Operators, $250k Chrome Exploit
Roundup covers ICS-Sniper, an XWorm panel RCE, an 11-million-record Burger King Japan breach, and a $250,000 Chrome chain.
78
How a leaked builder of XWorm turned a remote access trojan into a surveillance kit
Netskope says leaked XWorm builders turned the RAT into a surveillance kit with live browser, mic, and location plugins.
76
New 2CLoader Malware Evades Security Tools to Deploy Vidar and Remus Stealers
Zscaler found 2CLoader, a Windows loader delivering Vidar, Remus, and XWorm while evading analysis.
58
New 2CLoader Malware Uses Anti-VM and API Hooking to Deliver Vidar and Remus Stealers
Zscaler details 2CLoader, a Windows loader using anti-VM checks and API hooks to deploy Vidar and Remus.
64
Fake AI trading agent steals crypto wallet passwords
Fake AI crypto trading agent sites deliver Needle Stealer, which replaces browser wallet extensions to steal wallet passwords, HP reports.
65
Breeze Comet Executes Hundreds of Fraudulent Transactions via Brazilian Payment Systems
Google/Mandiant profile Breeze Comet, a Brazil-based e-crime group executing fraudulent Pix and STR payment transactions at banks, retailers, and fintechs.
82
H1 2026 Malware Vulnerability Trends
Recorded Future's H1 2026 report finds 215 actively exploited CVEs, RAT dominance, NFC payment fraud, and AI-augmented but not autonomous tradecraft.
78
Related CVEs
by mentions- Langflow: Any authenticated Langflow user can achieve Remote Code Execution (RCE) on the server by adding an MCP server with the "Stdio"…
Appears with
- Microsoftvendor · 5
- Windowsproduct · 3
- AnyDeskproduct · 2
- AsyncRATmalware · 2
- Vidarmalware · 2
- Microsoftorganization · 2
- Zscalerorganization · 2
- DCRatmalware · 2
- Anthropicvendor · 2
- Remusmalware · 2
- 2CLoadermalware · 2
- Googleorganization · 2
- Claudeproduct · 1
- Xeonproduct · 1
- Google Threat Intelligence Grouporganization · 1
- Coinbaseorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.