LATAM Businesses Hit by XWorm via Fake Financial Receipts: Full Campaign Analysis

Editor’s note: The current article is authored by Moises Cerqueira, malware researcher and threat hunter. You can find

Moises on LinkedIn.

Malware campaigns targeting Latin America (LATAM) are evolving. While the final payloads, often commodity RATs

like XWorm, remain consistent, delivery mechanisms are becoming increasingly sophisticated to bypass region-specific defenses and increase the chance of reaching real business users. In this analysis, we dissect a recent campaign targeting Brazilian users. What starts as a deceptive “banking receipt”

quickly turns into a multi-stage infection chain that leverages st…