New XWorm 7.1 and Remcos RAT Attacks Abuse Windows Tools to Evade Detection

Trellix research outlines two active, high-risk campaigns that use fileless RATs—XWorm (7.1/7.2) and Remcos—to achieve stealthy remote access and data theft; attackers exploit a WinRAR flaw (CVE-2025-8088) and distribute malicious archives via Discord and phishing, then abuse aspnet_compiler.exe and employ process hollowing to run solely in memory, evading traditional signature-based defenses.