Cybercriminals Use Fake Invoices to Deploy XWorm and Steal Login Credentials

According to Malwarebytes, security researchers have uncovered an active malware distribution operation that uses fake invoice emails to deploy Backdoor[.]XWorm, a remote-access Trojan (RAT) that can steal credentials, record keystrokes, and even deploy ransomware.

The campaign relies on Visual Basic Script attachments disguised as routine business correspondence, with subject lines about invoice processing and payment confirmations and a generic “Hi” greeting, followed by a signature simply listed as “Account Officer.” When opened, the .vbs file triggers an infection chain that drops IrisBud.bat, runs via Windows Management Instrumentation, and then loads an obfuscated PowerShell payload to unpack data in memory, enabling a fileless attack.

The final payload, Backdoor[.]XWorm, is described as a MaaS platform that allows attackers to exfiltrate files and passwords, capture keystrokes, monitor activity, and maintain backdoor access for future exploitation, including additional malware like ransomware. The article notes that nearly all corporate email gateways block .vbs attachments by default, highlighting the ongoing fragility of legacy scripting in modern phishing campaigns.