Malware Campaign Uses SVG Email Attachments to Deploy XWorm and Remcos RAT

Recent threat campaigns are using BAT-based loaders to deliver XWorm and Remcos RATs, starting with a ZIP that mimics legitimate content and is often hosted on ImgKit to entice interaction. According to GBHackers, the ZIP drops a highly obfuscated BAT script that spins up a PowerShell-based loader to inject the RAT payload into memory, enabling fileless execution and evading traditional endpoint protections.

The campaigns have expanded to using SVG files as an initial access vector, with embedded JavaScript that triggers the ZIP download when rendered or previewed. Once the ZIP is in place, the infection chain mirrors earlier activity: the obfuscated BAT loader executes, PowerShell injection occurs in memory, and the final payloads are deployed, with both XWorm and Remcos capable of keylogging, remote command execution, and data exfiltration.

The loader variants include loading .NET assemblies or decrypting shellcode, and AMSI and ETW are disabled in memory to suppress scanning and logging, while persistence is achieved by placing a copy in the Windows Startup folder. These campaigns underscore a shift towards non-traditional delivery formats and heightened emphasis on in-memory techniques, with two primary delivery methods noted: an email attachment within an EML file and a URL to ImgKit.