Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

Kaspersky Security Blog

Check Point Research

Reddit NetSec

CVE Database V5

Reddit InfoSec News

AlienVault OTX General

SecurityWeek

SANS ISC Handlers Diary

Threatpost

Dark Reading

The Hacker News

Exploit-DB RSS Feed

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Since the release of XWorm V6.0 on June 4, 2025, we have noted a surge in samples identified as XWorm V6.0 on VirusTotal, reflecting its rapid adoption by threat actors. One prominent campaign illustrates its delivery: a malicious JavaScript (JS) file initiates a PowerShell (PS1) script, which deploys an injector to deliver the XWorm Client.

XWorm V6 is a sophisticated remote access Trojan (RAT) that has gained rapid traction among threat actors since its release on June 4, 2025. The malware is primarily delivered through malicious JavaScript files that execute PowerShell scripts, which in turn deploy an injector to install the XWorm client on victim systems. This multi-stage infection chain allows the malware to evade traditional detection mechanisms by leveraging script-based execution and AMSI (Antimalware Scan Interface) bypass techniques. The malware incorporates a range of capabilities including remote desktop access, file management, credential harvesting, and process injection (notably process hollowing and thread injection), enabling attackers to maintain persistent and stealthy control over compromised hosts. The use of PowerShell and JavaScript as delivery and execution vectors aligns with common phishing campaigns, increasing the likelihood of successful initial compromise. The malware’s modular design allows it to load pivotal plugins that extend its functionality, making it adaptable to different operational needs. Although there are no known exploits in the wild targeting specific vulnerabilities, the threat relies heavily on social engineering and script execution to infiltrate environments. The tags associated with the threat (e.g., T1012, T1027, T1036, T1041, T1055, T1056, T1057, T1059) correspond to MITRE ATT&CK techniques such as system information discovery, obfuscated files or information, masquerading, command and control, process injection, input capture, system service discovery, and command-line interface usage, highlighting the malware’s comprehensive attack lifecycle. The absence of affected versions and patch links indicates that this is a malware campaign rather than a software vulnerability. The threat is documented by AlienVault and analyzed in detail by Trellix researchers, providing actionable intelligence for defenders.

MD5 of 570e4d52b259b460aa17e8e286be64d5bada804bd4757c2475c0e34a73aeb869

SHA1 of 570e4d52b259b460aa17e8e286be64d5bada804bd4757c2475c0e34a73aeb869

MD5 of 6a0c1f70af17bd9258886f997bb43266aa816ff24315050bbf5f0e473d059485

MD5 of 000185a17254cd8863208d3828366ec25ddd01596f18e57301355d4a33eac242

MD5 of d46bb31dc93b89d67abffe144c56356167c9e57e3235bfb897eafc30626675bb

MD5 of 1990659a28b2c194293f106e98f5c5533fdad91e50fdeb1a9590d6b1d2983ada

SHA1 of 1990659a28b2c194293f106e98f5c5533fdad91e50fdeb1a9590d6b1d2983ada

SHA1 of d46bb31dc93b89d67abffe144c56356167c9e57e3235bfb897eafc30626675bb

SHA1 of 000185a17254cd8863208d3828366ec25ddd01596f18e57301355d4a33eac242

SHA1 of 6a0c1f70af17bd9258886f997bb43266aa816ff24315050bbf5f0e473d059485

Detailed information about XWorm V6: Exploring Pivotal Plugins. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'file manager'

Filter Threats

Threats Tagged 'file manager'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility