New XWorm RAT Campaign Uses Themed Phishing Lures and CVE‑2018‑0802 Excel ...

Back Cybersecuritynews

New XWorm RAT Campaign Uses Themed Phishing Lures and CVE‑2018‑0802 Excel ...

Cybersecuritynews • February 13, 2026

Share: View original

Infection mechanism. When CVE ‑2018‑0802 is triggered, the shellcode downloads an HTA from retrodayaengineering[.]icu/HGG.hta and saves it as ...

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

XWorm RAT Campaign Utilizes Phishing and CVE-2018-0802 Exploit A new phishing campaign has been detected distributing an updated variant of the XWorm Remote Access Trojan (RAT), which exploits CVE-2018-0802 to evade detection. This campaign targets Microsoft Windows systems and is actively traded in Telegram marketplaces, affecting numerous users since its first tracking in 2022. 4 sources 49

Extracted Entities

Attack Types (2)

Malware Phishing

Campaigns (1)

XWorm RAT Campaign

Malware (1)

MITRE ATT&CK (3)

T1105 - Ingress Tool Transfer T1203 - Exploitation for Client Execution T1566 - Phishing