Hacker infects 18,000 "script kiddies" with fake malware builder

A trojanized XWorm RAT “builder” was distributed via GitHub, file hosts, Telegram, YouTube and websites targeting novice ‘script kiddies’; instead of providing a builder it infected users with a backdoor that registered victims to a Telegram-based C2, stole Discord/browser tokens and system data, and supported 56 commands including keylogging, screen capture, file exfiltration and file encryption. Researchers at CloudSEK observed ~18,459 infected devices (majority in Russia, US, India, Ukraine, Turkey), data exfiltration from ~11% of victims, and partly disrupted the botnet by leveraging hard-coded API tokens and a built-in kill switch—though some hosts remain compromised due to offline machines and Telegram rate limits.