X-VPN Installer Hijacked to Spread STX RAT Malware

A month-long supply-chain operation trojanized installers for cryptocurrency trading tools and ultimately an X-VPN package used by millions; a malicious CRYPTBASE.dll sideloaded STX RAT into memory to steal credentials and provide remote access. The campaign was hosted via a Bitbucket repo and used infrastructure tied to supp0v3.com, and X-VPN released a patch (version 77.5.3) to mitigate the DLL sideloading (CWE-427) vulnerability—users who installed from unofficial sources are at risk.