Excel Trap: New Phishing Campaign Deploys Fileless XWorm RAT

A recent phishing campaign uses business-themed lures and malicious Excel add-in (.XLAM) files exploiting CVE-2018-0802 to deliver XWorm RAT (v7.2). The multi-stage attack retrieves an HTA that runs PowerShell to load a fileless .NET payload hidden inside a JPEG, then uses process hollowing into Msbuild.exe to execute the RAT, which provides remote control, surveillance, data theft, ransomware and DDoS capabilities and communicates with AES-encrypted C2.