#Lumma, #XWorm, and #Snake became the top uploaded threats in Q1 2025
Discover the full #Malware Trends report for insights into the most widespread malware families, types, and TTPs, based on data from 15,000 companies: https://any.run/cybersecurity-blog/malware-trends-q1-2025/?utm_source=mastodon&utm_medium=post&utm_campaign=q1_25_2&utm_content=linktoblog&utm_term=020525
Top 10 last week's threats by uploads 
#Lumma 569 (1077)
#Tofsee 363 (263) #Xworm 309 (1099) #Asyncrat 290 (395) #Neconyd 283 (169) #Snake 254 (379) #Remcos 232 (566) #Amadey 156 (380) #Formbook 134 (78) #Agenttesla 114 (271)
Track them all: https://any.run/malware-trends/?utm_source=mastodon&utm_medium=post&utm_campaign=top_ten&utm_content=tracker&utm_term=280425
Top 10 last week's threats by uploads #Lumma 592 (644) #Snake 306 (513) #Xworm 281 (341) #Asyncrat 277 (303) #Tofsee 264 (194) #Remcos 240 (203) #Agenttesla 195 (326) #Neconyd 169 (154) #Amadey 108 (95) #Quasar 91 (82)
Track them all: https://any.run/malware-trends/?utm_source=mastodon&utm_medium=post&utm_campaign=top_ten&utm_content=tracker&utm_term=210425
Proton66: Compromised WordPress Pages and Malware Campaigns
This intelligence briefing focuses on malware campaigns linked to Proton66, particularly those targeting Android devices through compromised WordPress websites. It details how these sites were injected with malicious scripts to redirect Android users to fake Google Play Store pages. The report also covers the XWorm campaign targeting Korean-speaking users, the Strela Stealer targeting German-speaking countries, and the WeaXor ransomware. The analysis provides insights into the infection chains, malware configurations, and command-and-control servers used in these campaigns. Additionally, it offers recommendations for blocking associated IP ranges and lists numerous indicators of compromise (IOCs) for each campaign.
Pulse ID: 6802094e89f266c72f83bda4
Pulse Link: https://otx.alienvault.com/pulse/6802094e89f266c72f83bda4
Pulse Author: AlienVault
Created: 2025-04-18 08:11:58
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
JScript to PowerShell: Breaking Down a Loader Delivering XWorm and Rhadamanthys
This analysis examines a sophisticated malware loader that utilizes JScript to launch obfuscated PowerShell code, ultimately delivering payloads such as XWorm and Rhadamanthys. The loader employs geofencing tactics, targeting victims in the United States with XWorm RAT, while deploying Rhadamanthys stealer to users outside the U.S. The attack chain involves multiple stages of obfuscation and deobfuscation, including decimal encoding and string manipulation. The final payload is injected into RegSvcs.exe using reflective loading techniques. The loader also performs various cleanup actions to evade detection and remove traces of its activity. Both XWorm and Rhadamanthys are advanced malware variants with capabilities ranging from DDoS attacks to cryptocurrency theft.
Pulse ID: 67ff46c3697a4976dc919b5d
Pulse Link: https://otx.alienvault.com/pulse/67ff46c3697a4976dc919b5d
Pulse Author: AlienVault
Created: 2025-04-16 05:57:23
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
Malicious JScript Loader Jailbreaked to Uncover Xworm Payload Execution Flow
A new malware campaign has been identified leveraging JScript and obfuscated
PowerShell commands to deliver highly evasive malware variants XWorm and
Rhadamanthys. These threats are distributed using fileless techniques, making
them extremely difficult to detect using traditional antivirus solutions. The
campaign primarily targets Windows environments and utilizes scheduled tasks
or deceptive ClickFix CAPTCHA screens to trick users into executing malicious
payloads. Such loaders are often seen in enterprise environments, where attackers
aim to infiltrate business systems for espionage, data theft, or financial gain.
Pulse ID: 67fef516074ec94b68f3a8e7
Pulse Link: https://otx.alienvault.com/pulse/67fef516074ec94b68f3a8e7
Pulse Author: cryptocti
Created: 2025-04-16 00:08:54
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
Phishing campaign impersonates Booking.com, delivers a suite of credential-stealing malware
A phishing campaign targeting organizations in the hospitality industry has been identified, impersonating Booking.com and using the ClickFix social engineering technique to deliver multiple credential-stealing malware. The campaign, tracked as Storm-1865, targets individuals likely to work with Booking.com in North America, Oceania, Asia, and Europe. The attack uses fake emails and webpages to trick users into executing malicious commands, leading to the download of various malware families including XWorm, Lumma stealer, VenomRAT, AsyncRAT, Danabot, and NetSupport RAT. The campaign aims to steal financial data and credentials for fraudulent use, showing an evolution in the threat actor's tactics to bypass conventional security measures.
Pulse ID: 67fb93e8ebc93d6ded395f39
Pulse Link: https://otx.alienvault.com/pulse/67fb93e8ebc93d6ded395f39
Pulse Author: AlienVault
Created: 2025-04-13 10:37:28
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
Top 10 last week's threats by uploads #Lumma 630 (647) #Tofsee 529 (524) #Xworm 305 (789) #Snake 251 (376) #Neconyd 218 (36) #Asyncrat 165 (377) #Amadey 146 (962) #Remcos 127 (876) #Agenttesla 116 (145) #Quasar 111 (107)
Track them all: https://any.run/malware-trends/?utm_source=mastodon&utm_medium=post&utm_campaign=top_ten&utm_content=tracker&utm_term=140425
Top 10 last week's threats by uploads #Lumma 630 (647) #Tofsee 529 (524) #Xworm 305 (789) #Snake 251 (376) #Neconyd 218 (36) #Asyncrat 165 (377) #Amadey 146 (962) #Remcos 127 (876) #Agenttesla 116 (145) #Quasar 111 (107)
Track them all: https://any.run/malware-trends/?utm_source=mastodon&utm_medium=post&utm_campaign=top_ten&utm_content=tracker&utm_term=070425
Top 10 last week's threats by uploads #Amadey 963 (156) #Remcos 880 (923) #Xworm 792 (967) #Lumma 673 (659) #Tofsee 535 (144) #Snake 403 (326) #Asyncrat 380 (433) #Stealc 157 (171) #Agenttesla 153 (245) #Vidar 151 (178)
Track them all: https://any.run/malware-trends/?utm_source=mastodon&utm_medium=post&utm_campaign=top_ten&utm_content=tracker&utm_term=310325
#xworm SHA256: eb289453cd40a271796f5492644a6af1f5e424fa616d286cddf746d8e8bc3a63 C2: Dyno15-41078[.]portmap[.]host:41078
#xworm SHA256: eb289453cd40a271796f5492644a6af1f5e424fa616d286cddf746d8e8bc3a63 C2: Dyno15-41078[.]portmap[.]host:41078
#xworm SHA256: 1acfdea87feabe2cec4aa9c09f604d0546ae4f8a30884df850a530bd40c2d769 C2: even-legislative[.]gl[.]at[.]ply[.]gg:26290
Top 10 last week's threats by uploads #Xworm 983 (391) #Remcos 936 (172) #Lumma 686 (531) #Asyncrat 436 (279) #Snake 346 (315) #Agenttesla 251 (161) #Dcrat 189 (192) #Vidar 184 (59) #Stealc 176 (49) #Amadey 160 (91)
Track them all: https://any.run/malware-trends/?utm_source=mastodon&utm_medium=post&utm_campaign=top_ten&utm_content=tracker&utm_term=240325
#xworm SHA256: e360e64ffc41dbfc106bcbb6ffe08dabdcdb164bbff07a0f7eac5e21a82ec3ca C2: https://pastebin[.]com/raw/jV6dpDfD,5[.]tcp[.]eu[.]ngrok[.]io:14267
#xworm SHA256: d8029cce4d071a86c93129fff33be9fc450c52f475e3d9639303ca3bc51cfa22 C2: improve-gis[.]gl[.]at[.]ply[.]gg:33898
#xworm SHA256: d8029cce4d071a86c93129fff33be9fc450c52f475e3d9639303ca3bc51cfa22 C2: improve-gis[.]gl[.]at[.]ply[.]gg:33898
#xworm SHA256: f2d8a46919285b3cdcd64be5caed2dda21c81eb7de6a7ebbb6f4720f5f70c665 C2: even-legislative[.]gl[.]at[.]ply[.]gg:26290
#xworm SHA256: f2d8a46919285b3cdcd64be5caed2dda21c81eb7de6a7ebbb6f4720f5f70c665 C2: even-legislative[.]gl[.]at[.]ply[.]gg:26290
Steganography Explained: How XWorm Hides Inside Images — https://thehackernews.com/2025/03/steganography-explained-how-xworm-hides.html?m=1 #Cybercrime #Steganography #XWorm
