Hackers Reuse XWorm Malware Loader Across Phishing Campaigns Targeting Colombia and the UK

A judicial-themed phishing campaign targeting Colombian organizations that delivers XWorm through obfuscated scripts, encrypted PowerShell, and a reusable .NET loader. The recovered loader is binary-identical to one documented in a September 10, 2026, UK-linked case, connecting otherwise differently packaged delivery chains. The overlap establishes loader reuse, not common attribution. Different payload hashes, execution targets, and […]

Read the original article:

Hackers Reuse XWorm Malware Loader Across Phishing Campaigns Targeting Colombia and the UK