Scworld XWorm 7.2 Malware Campaign Targets Businesses via Phishing Emails
Article Content
Browse articles 
A new phishing campaign is distributing the XWorm 7.2 Remote Access Trojan (RAT) through malicious Excel attachments disguised as business communications. The malware is being sold on Telegram marketplaces, allowing a wider range of cybercriminals to exploit it. Key techniques include hiding the malware within Windows processes and using AES encryption to steal sensitive information.
Ask AI about this cluster
Answers cite the sources they use
Updated 227d ago How this analysis works
Timeline
2018-01-10
CVE-2018-0802 published
2026-02-23
Hackread reports on XWorm 7.2 phishing campaign
2026-02-24
Scworld reports on XWorm malware campaign
More articles in this cluster (2)
Following this threat?
Track XWorm and CVE-2018-0802 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
XWorm RAT Transforms into Advanced Surveillance Tool The XWorm Remote Access Trojan (RAT) has evolved into a sophisticated surveillance platform, according to cybersecurity firm Netskope. Initially identified in 2022, XWorm now includes 46 plugins, up from 35 in July 2025, enabling capabilities such as GPS location tracking, live audio streaming, and webcam access.… 
2CLoader Malware Loader Distributes Vidar and Remus Infostealers Zscaler ThreatLabz has identified a new malware loader named 2CLoader, which is used to deliver infostealers Vidar and Remus, as well as XWorm RAT. The loader employs advanced evasion techniques to bypass security measures, including indirect system calls and anti-debugging checks. Organizations are advised to enhance…