We opened a fake invoice and fell down a retro XWorm-shaped wormhole

According to Malwarebytes, a forwarded “invoice” email with a .vbs attachment would have silently installed a remote-access Trojan known as Backdoor[.]XWorm, enabling attackers to steal data, record keystrokes, spy on the user and even install ransomware. The sample was flagged after researchers analysed the attachment named INV-20192,INV-20197.vbs, which dropped IrisBud.bat into the %TEMP% folder and copied itself to the user’s profile as aoc.bat before loading a PowerShell payload in memory.

The article notes that XWorm is a RAT sold as malware-as-a-service, designed to evade antivirus tools and operate without visible alerts. In their deep-dive, Malwarebytes explains how the BAT script decodes a hidden PowerShell command from a batch file, decrypts and decompresses encrypted data, and then runs two executables directly in memory to form a “fileless” attack.

The piece, posted on 13 November 2025, also offers practical safety tips such as double‑checking unexpected attachments, avoiding .vbs files, and keeping real‑time protection up to date.