HACKERS USE FAKE INVOICES TO SPREAD XWORM RAT VIA OFFICE FILES

Summary from the TLDR InfoSec newsletter

Cybercriminals are distributing XWorm RAT through fake Spanish invoice emails containing malicious .xlam Office files that appear blank when opened but execute hidden shellcode to download additional payloads. The attack chain employs reflective DLL injection and process injection techniques to embed the malware within legitimate processes, thereby enabling complete remote system control, including keystroke logging and file theft, while establishing a connection to a C2 server at 158.94.209.180. This represents a continuation of XWorm campaigns that have compromised over 18,000 devices globally this year, with attackers increasingly leveraging trusted platforms, such as AWS S3, for payload distribution.