Threat actors are Weaponizing Invoices to Deliver XWorm That Steals Login Credentials

Du'aine Davis

Observed in the wild

• On 5 November, On 13 November 2025, a phishing email disguised as an invoice targeted recipients with a malicious Visual Basic Script (.vbs) attachment. If opened, it installed Backdoor.XWorm, a remote-access Trojan (RAT) capable of stealing credentials, recording keystrokes, spying on users, and deploying additional malware, including ransomware. The attack leveraged outdated scripting technology to bypass modern security expectations.
• The threat used a .vbs file to drop an obfuscated batch script, which executed a PowerShell loader for a fileless attack. This loader decrypted and ran the XWorm payload directly in memory, avoiding disk-based detection..
• Organisations should block legacy script types (.vbs, .bat) at email gateways, enable file extension visibility, and educate users to verify unexpected attachments. Monitor for suspicious PowerShell activity, hidden file extensions (e.g., invoice.pdf.vbs), and indicators of compromise such as IrisBud.bat or aoc.bat in user directories.

We opened a fake invoice and fell down a retro XWorm-shaped wormhole | Malwarebytes