From Business Emails to XLoader: An Order Lure That Led to In-Memory Injection

This threat involves a malware campaign using business-themed email lures to deliver XLoader and other payloads. The attack starts with emails containing RAR archives with obfuscated JScript files that extract and execute a LuaJIT interpreter and loader. The loader performs in-memory execution of the XLoader core via manual mapping and shared-section injection into target processes. The malware steals credentials including Windows Vault data and browser cookies and communicates with multiple command-and-control servers. Additional malware such as Agent Tesla, Remcos, and XWorm are also delivered in this campaign.

• Inside SiriusQT: A Seriously Skilled RATMalware2026-10-22
• Not Actually Suspended: How a Bank-Phishing Network Fakes Its Own TakedownPhishing2026-11-04
• Inside a malicious Claude Code-branded extension and its persistent SSH backdoorMalware2026-10-31
• Hackers Use Fake ChatGPT Plus Billing Emails to Steal Credit Card Details and OTP CodesCampaign2026-11-02
• Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealerMalware2026-10-31