Intelligence Newsroom
XWorm Intelligence Newsroom
CMS-tracked XWorm intelligence events with publisher, version, campaign, actor, confidence, and last-verified metadata.
2026-08-28·URLhausconfirmed
URLhaus records continued XWorm payload distribution
URLhaus records XWorm payload activity extending through 2026, with 1,188 unique payloads and 1,101 associated URLs in the research snapshot.
XWormURLhausThreat Intelligence
2026-07-01·Public reporting·xplogs22medium
xplogs22 cluster reported using XWorm against Russia/CIS targets
Public reporting in July 2026 described the xplogs22 cluster using XWorm against Russia/CIS targets. Commodity malware can be used by many unrelated operators.
XWormPhishingThreat Actor
2026-05-14·Point Wild / Lat61·v7.4confirmed
Point Wild / Lat61 documents XWorm 7.4 multi-stage infection chain
Independent research published May 14, 2026 documented a multi-stage infection delivering XWorm 7.4.
XWormXWorm 7.4Threat Intelligence
2026-04-02·ANY.RUN·v7.4confirmed
ANY.RUN analyzes XWorm 7.4 sample
Public sandbox analysis of an XWorm 7.4 sample documented persistence, scheduled-task, Startup and autorun activity with C2 communication.
XWormXWorm 7.4ANY.RUN
2026-02-10·FortiGuard Labs·v7.2confirmed
FortiGuard Labs documents XWorm 7.2 in multilingual phishing campaign
Fortinet published analysis of a business-themed phishing campaign delivering XWorm 7.2 via malicious Excel attachments exploiting CVE-2018-0802.
XWormXWorm 7.2PhishingCVE-2018-0802
2025-06-27·Trellix·v6.0confirmed
Trellix reports cracked XWorm 6.0 builder appearing publicly
On June 27, 2025 Trellix reported a cracked XWorm 6.0 builder appearing publicly, accelerating ecosystem fragmentation.
XWormXWorm 6XCoderToolsCracked
2025-06-04·Trellix·v6.0·XCoderToolshigh
XCoderTools advertises XWorm 6.0
On June 4, 2025 an identity named XCoderTools advertised XWorm 6.0, claiming substantial recoding. Relationship to original XCoder unconfirmed.
XWormXWorm 6XCoderToolsMalware-as-a-Service
