XWorm RAT Exploits CVE-2018-0802 in Phishing Campaign

XWorm RAT Exploits CVE-2018-0802 in Phishing Campaign

First seen 12 Feb 2026, 22:38 UTC •Socprime •80% similarity •54.6

Article Content

Browse articles
ThreatCluster

A multi-stage phishing campaign has been detected distributing the XWorm remote access trojan (RAT) via malicious Excel attachments. The attack leverages CVE-2018-0802 in Microsoft Equation Editor to execute a fileless .NET loader, which injects XWorm into a new Msbuild.exe process. The RAT utilizes AES-encrypted communication with its command and control server and supports various plugins for extended functionality.

ThreatCluster AI

Timeline

2018-01-10
CVE-2018-0802 published
2018-01-11
First public PoC for CVE-2018-0802
2021-11-03
CVE-2018-0802 added to CISA KEV (active exploitation)
Recent
XWorm phishing campaign observed distributing RAT

Extracted Entities

1 / 2

Community

Browse all →

Tracked Entities in This Story

XWorm HTA Microsoft Excel Malware Phishing Microsoft Equation Editor MSBuild PowerShell