XWorm Malware Delivered via Fake Financial Receipts Targeting Windows Systems to Steal Logins and Sessions

Cybersecurity: XWorm v5.6 Malware Campaign Targeting LATAM Businesses

A multi-stage malware campaign is currently targeting Brazilian and Latin American businesses using fake bank receipts to deploy XWorm v5.6, a remote access trojan (RAT). This malware is designed to steal credentials, hijack sessions, and facilitate ransomware deployment.

The campaign begins with a file disguised as a Bradesco bank receipt. The file uses a double-extension trick (.pdf.js) to appear as a legitimate PDF document. In reality, it is a Windows Script Host (WSH) dropper, inflated with junk data to evade static analysis scanners and pass gateway controls.

The JavaScript payload within the file is obfuscated using Unicode "junk injection," embedding malicious logic within large string variables. A delimiter-based reconstruction method strips away the noise at runtime to rebuild the PowerShell command responsible for fetching the next stage.

Stage 2: Steganography and Cloudinary Abuse

The decoded PowerShell command accesses a Cloudinary URL to download a JPEG file. The image file contains a hidden .NET assembly, which is extracted and loaded into memory without writing to the hard drive, employing a fileless execution technique.

Before invoking the assembly, the loader decodes a Base64 argument string that reveals the final XWorm payload URL. Instead of using a detectable command, the Stage 3 VB.NET DLL interacts directly with the Windows Task Scheduler to execute the Stage 2 PowerShell loader on each logon.

The final payload, identified as XWorm v5.6, is a reversed Base64-encoded .NET executable. It injects itself into CasPol.exe , a legitimate binary, to blend with trusted system processes.

Once XWorm establishes control, attackers can harvest browser sessions, steal credentials, log keystrokes, and access email, SaaS, and financial platforms. The stealthy nature of this campaign inflates Mean Time to Respond (MTTR), as initial events appear benign.

Delivery stage: Alert on .js or double-extension files ( .pdf.js ) that spawn WMI-invoked PowerShell processes. Network stage: Flag outbound traffic to image hosting services where responses contain non-standard markers like BaseStart . Endpoint stage: Treat outbound network connections from CasPol.exe as high-confidence malicious activity.

Security teams can query threat intelligence platforms to identify the latest XWorm samples and related delivery domains.

Based on reporting by Cyber Security News.