Socprime XWorm RAT Exploits CVE-2018-0802 in Phishing Campaign
Article Content
Browse articles 
A multi-stage phishing campaign has been detected distributing the XWorm remote access trojan (RAT) via malicious Excel attachments. The attack leverages CVE-2018-0802 in Microsoft Equation Editor to execute a fileless .NET loader, which injects XWorm into a new Msbuild.exe process. The RAT utilizes AES-encrypted communication with its command and control server and supports various plugins for extended functionality.
Ask AI about this cluster
Answers cite the sources they use
Updated 228d ago How this analysis works
Timeline
2018-01-10
CVE-2018-0802 published
2018-01-11
First public PoC for CVE-2018-0802
2021-11-03
CVE-2018-0802 added to CISA KEV (active exploitation)
Recent
XWorm phishing campaign observed distributing RAT
More articles in this cluster (1)
Following this threat?
Track XWorm and CVE-2018-0802 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
XWorm RAT Transforms into Advanced Surveillance Tool The XWorm Remote Access Trojan (RAT) has evolved into a sophisticated surveillance platform, according to cybersecurity firm Netskope. Initially identified in 2022, XWorm now includes 46 plugins, up from 35 in July 2025, enabling capabilities such as GPS location tracking, live audio streaming, and webcam access.… 2CLoader Malware Loader Distributes Vidar and Remus Infostealers Zscaler ThreatLabz has identified a new malware loader named 2CLoader, which is used to deliver infostealers Vidar and Remus, as well as XWorm RAT. The loader employs advanced evasion techniques to bypass security measures, including indirect system calls and anti-debugging checks. Organizations are advised to enhance…