Loading story…
Researchers reported that XWorm re-emerged with the release of XWorm V6 after the malware had been widely considered abandoned, and that its latest campaigns used a modular plugin architecture to expand capabilities on infected Windows systems. In one observed chain, a malicious JavaScript file launched PowerShell, disabled AMSI, deployed an injector DLL, and injected the XWorm client into RegSvcs.exe, after which the malware contacted a command-and-control server at 94.159.113.64:4411. The malware stored plugins in the registry and retrieved them on demand to enable remote desktop control, shell access, credential theft, browser data theft, file management, persistence, and ransomware activity; researchers also linked some browser-theft components to public proof-of-concept code designed to bypass Chrome v20 protections.
Separate reporting found that threat actors were circulating a trojanized XWorm builder, underscoring infighting in the cybercrime ecosystem and showing that some operators and would-be customers were themselves being infected. Trellix likewise observed cracked and modified XWorm V6 builders, including leaked V6.4 variants containing Rootkit.dll and ResetSurvival.dll, and said some builders and operators had been compromised by XWorm malware. The malware’s persistence methods included logon scripts, Run keys, and abuse of ResetConfig.xml, while operators also deployed payloads such as DarkCloud Stealer, Remcos RAT, and other stealers; its ransomware plugin used AES-CBC, dropped a ransom note, changed the victim’s wallpaper, and showed code overlap with NoCry ransomware.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
A Hackforums post from the account XCoderTools announced XWorm V6.0 on June 4, 2025, claiming the new version fixed the prior remote code execution vulnerability affecting V5.6 and earlier.
After the June 2025 release of XWorm V6.0, Trellix observed a surge of related samples being uploaded to VirusTotal, indicating renewed activity around the malware family.
After releasing XWorm V5.6, XWorm developer XCoder disappeared in the latter half of 2024, contributing to the belief that the malware project had been abandoned.
XWorm was first observed in 2022 as a modular malware family built around a core client with multiple plugins.
Following XWorm's apparent abandonment, threat actors began distributing cracked or modified XWorm V5.6 versions, including trojanized builders.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
XWorm, a modular remote access trojan (RAT) first observed in 2022, has re-emerged in the threat landscape with significant enhancements in its latest versions, including 6.0, 6.4, and 6.5. The malware, originally developed by an individual known as XCoder, has evolved into a highly versatile tool capable of supporting a wide array of malicious activities on compromised Windows hosts. After XCoder abandoned the project and deleted their Telegram accounts, multiple threat actors began distributing cracked versions of XWorm, leading to a surge in its adoption and deployment. The new variants now support over 35 specialized plugins, enabling functionalities such as data theft from browsers and applications, keylogging, screen capture, clipboard monitoring, and even ransomware operations that can encrypt or decrypt files. XWorm’s modular design allows operators to issue commands from external servers, including downloading files, opening URLs, shutting down or restarting systems, and launching distributed denial-of-service (DDoS) attacks. The malware is primarily propagated through phishing emails and malicious websites, often using deceptive installers for legitimate software like ScreenConnect or Discord. Infection chains have been observed leveraging Windows shortcut (LNK) files and malicious JavaScript to execute PowerShell commands, sometimes bypassing Antimalware Scan Interface protections. The last version developed by XCoder, 5.6, contained a remote code execution vulnerability, which has been addressed in the newer releases. XWorm’s anti-analysis and anti-evasion mechanisms allow it to detect virtualized environments and cease execution to avoid detection. The malware’s popularity is underscored by campaigns that have resulted in tens of thousands of infections, with significant activity noted in countries such as Russia, the United States, India, Ukraine, and Turkey. Some threat actors have even used XWorm as a lure to target less-skilled cybercriminals, embedding backdoors to steal data from those attempting to use the malware. Security researchers, particularly from Trellix, have documented a marked increase in XWorm samples on platforms like VirusTotal since June, indicating widespread adoption among cybercriminals. The rapid evolution and prevalence of XWorm highlight the critical need for robust security measures, user awareness, and advanced detection capabilities to mitigate the risks posed by this adaptable malware. Organizations are advised to monitor for phishing campaigns, scrutinize suspicious attachments and downloads, and ensure endpoint protection solutions are updated to detect the latest XWorm variants. The ongoing development and distribution of XWorm by multiple actors suggest that it will remain a persistent threat in the cybercrime ecosystem.
Jun 29, 2026
Researchers reported that **XWorm**, a .NET-based Windows remote access trojan, has been both actively deployed in phishing attacks and marketed online as a builder for criminal operators. The malware has been advertised with modules for **RAT control, ransomware, HVNC, hidden RDP, DDoS, keylogging, credential theft, clipper functions, and persistence**, while incident analysis found live samples communicating with command-and-control servers such as `system6458[.]ddns[.]net` over port `6666`. Reverse engineering also showed that XWorm uses anti-analysis checks to terminate in virtualized or sandboxed environments and can persist through startup-folder copies, scheduled tasks, AppData placement, and registry autorun entries. Separate investigations tied XWorm to ongoing delivery campaigns, including the **MEME#4CHAN** phishing operation, which used fake hotel reservation lures and Microsoft Word documents exploiting `CVE-2022-30190` to launch multi-stage infection chains involving PowerShell, JScript, and in-memory .NET loading. Analysts found XWorm variants capable of **PowerShell execution, in-memory .NET execution, screenshots, plugin retrieval, USB spreading, uninstall functions, and DDoS**, with configuration fields such as `Host`, `Port`, and `KEY` encrypted using AES and derived keys. In some intrusions, the malware disabled **AMSI**, weakened Microsoft Defender, created a local administrator account named **System32**, disabled the Windows Firewall, and injected the final payload into processes including `RegSvcs.exe` and `Msbuild.exe`, with observed C2 infrastructure including `212.87.204[.]83:3000` and `port3000newspm.duckdns[.]org`.
Aug 15, 2026
Researchers reported evolving **multi-stage, script-heavy infection chains** used to deliver remote access trojans, including **XWorm**, **AsyncRAT**, and **Xeno RAT**. Securonix described a campaign dubbed **VOID#GEIST** that starts from phishing-delivered batch scripts fetched from *TryCloudflare* infrastructure, then chains additional batch/PowerShell stages, deploys a legitimate embedded Python runtime, decrypts shellcode, and executes it filelessly by injecting into `explorer.exe` using **Early Bird APC injection**, reducing disk artifacts and making each stage appear benign in isolation. Separately, SANS ISC documented another **XWorm** wave using an obfuscated JavaScript-to-PowerShell loader chain that drops a temporary PowerShell script (e.g., `C:\Temp\ps_...ps1`), decodes additional in-memory PowerShell, and uses a DLL exporting `ProcessHollowing` to inject the XWorm client into a .NET compiler process. The write-up included configuration and IOCs such as a C2 endpoint `204[.]10[.]160[.]190:7003`, mutex `Cqu1F0NxohroKG5U`, and multiple SHA-256 hashes for the JavaScript, PowerShell, DLL loader, and XWorm payload, indicating continued high-volume distribution with frequently changing delivery techniques.
Jun 29, 2026