Attackers Adopting Novel LOTL Techniques to Evade Detection

HP Wolf's Q2 2025 Threat Insights report documents several active, evolving malware campaigns that chain living-off-the-land tools to evade detection—notably an XWorm RAT hidden in image pixels and executed via MSBuild, SVG-based browser lures that fetch obfuscated JavaScript, and Lumma Stealer distributed in IMG archives and installed via NSIS—highlighting novel TTPs (steganography, uncommon binaries, geofencing, multi-stage PowerShell/HTA/NSIS chains) and ongoing operator activity despite prior takedowns.