Hackers Hide XLoader Malware in Fake Business Orders Using LuaJIT Injection
First merged summary.
Hackers abuse LuaJIT and Windows process injection to hide XLoader credential-stealing malware in business-themed email lures.
Hackers abuse LuaJIT and Windows process injection to hide XLoader credential-stealing malware. The campaign uses business-themed email lures and delivered Agent Tesla, Remcos and XWorm. The chain starts with order and payment emails containing RAR archives with obfuscated JScript that launches the hidden loader.
- Script drops EHFTUOMQDRXVTJSF.exe and FSJTVXRDQMOUTFHE in Documents folder
- XLoader uses shared-section injection in suspended SysWOW64 process
- Conditional persistence creates scheduled task every ten minutes with .mui marker
- Campaign lures via order/payment emails with RAR archives and obfuscated JScript
- Delivers Agent Tesla, Remcos and XWorm
What each outlet adds
beyond the shared facts- Cyber Security NewsReport on XLoader hiding via LuaJIT in fake orders
- GBHackersAnalysis of shared-section injection for credential stealer
Coverage
oldest first · one row per article · UTC- · 5d ago
Cyber Security NewsFirst report
XLoader Malware Uses LuaJIT and Injection to Hide Credential Stealer
The loader hides the credential stealer inside an embedded LuaJIT interpreter and moves it into another Windows process through shared-section injection.
- · 5d ago
GBHackers
XLoader Malware Uses LuaJIT and Injection to Hide Credential Stealer
The loader hides the credential stealer inside an embedded LuaJIT interpreter and moves it into another Windows process through shared-section injection.