Hackers Use Excel Exploit to Hide XWorm 7.2 in JPEG Files, Hijack PCs

[Brownie2019]

Content source

https://hackread.com/hackers-excel-exploit-xworm-7-2-jpeg-files-hijack-pcs/

If a strange email about a “payment detail request” or “signed bank document” lands in your inbox, your best bet is to delete it immediately. A fresh investigation by Fortinet’s FortiGuard Labs warns that scammers are using these mundane business themes to infect Windows PCs with XWorm malware.

XWorm is a Remote Access Trojan (RAT), which is a tool capable of giving a hacker full remote control of compromised Windows systems. While the virus has been around since 2022, this latest version (XWorm 7.2) is a much more advanced breed that surfaced on Telegram marketplaces as recently as late 2025 and early 2026.

How the Trap is Set

Read full Story:

Hackers Use Excel Exploit to Hide XWorm 7.2 in JPEG Files, Hijack PCs

A new phishing campaign is spreading XWorm 7.2 via malicious Excel files, hiding malware in Windows processes to steal passwords and Wi-Fi keys.

hackread.com

 

[Parkinsond]

These emails usually come with an Excel attachment; when opened, the file exploits an old security vulnerability tracked as CVE-2018-0802.
This triggers a domino effect, running a hidden script (an HTA file) which uses PowerShell to download what looks like a normal JPEG photo.

Would ASR rule "Block all Office applications from creating child processes" stop running the hidden HTA, and constrained language mode stop PS download of file?

 

[Halp2001]

Watch out! XWorm 7.2 is using steganography in JPEGs and Excel exploits to slip under the radar.

Quick defense:

1. Disable macros (VBA) via GPO or local settings.
2. If the attachment looks suspicious, straight to Sandbox/VM or Any.run before touching it.

Thanks for the heads-up, @Brownie2019 !

 

[Sampei.Nihira]

Would ASR rule "Block all Office applications from creating child processes" stop running the hidden HTA, and constrained language mode stop PS download of file?

I hope you are not using "Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, or Microsoft Office 2016".
These software programs are affected by the exploit that leverages CVE-2018-0802.

And if you use them considering that it is a memory vulnerability, I hope you have added them to the MD AE list.

Furthermore, the connection to Berlin101[.]com is not only blocked by MD, but it is also an insecure connection, and moreover blocked by the elimination of my Insecure Cipher Suites.
So this is an infection that should not even remotely start on PCs like those of the users of this forum.

 

[Parkinsond]

I hope you are not using "Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, or Microsoft Office 2016".
These software programs are affected by the exploit that leverages CVE-2018-0802.

And if you use them considering that it is a memory vulnerability, I hope you have added them to the MD AE list.

Furthermore, the connection to Berlin101[.]com is not only blocked by MD, but it is also an insecure connection, and moreover blocked by the elimination of my Insecure Cipher Suites.
So this is an infection that should not even remotely start on PCs like those of the users of this forum.

Using MS Office 2024 updated to the latest build with macros disabled and internet connectivity is blocked for through firewall.

 

[Sampei.Nihira]

Using MS Office 2024 updated to the latest build with macros disabled and internet connectivity is blocked for through firewall.

So:
no-problem.

 

[ForgottenSeer 123960]

Technical Analysis & Remediation

MITRE ATT&CK Mapping

T1566.001
(Phishing: Spearphishing Attachment).

T1059.001
(Command and Scripting Interpreter: PowerShell).

T1055.004
(Process Injection: Process Hollowing)

CVE Profile
CVE-2018-0802
NVD Score: 7.8
CISA KEV Status: Active.

Telemetry

Hashes
Unknown (Origin: Insufficient Evidence).

C2 Domain
"berlin101.com" (Port 6000, AES encrypted).

Processes
"Msbuild.exe" (Target for hollowing).

Registry Keys
Unknown. The malware reportedly hides in the system registry, but exact keys are undefined.

Constraint
The payload structure resembles a modular .NET Remote Access Trojan (XWorm 7.2) utilizing image files strictly as data containers.

Remediation - THE ENTERPRISE TRACK (NIST SP 800-61r3 / CSF 2.0)

GOVERN (GV) – Crisis Management & Oversight

Command
Initiate emergency patch management protocol for all Microsoft Office installations regarding CVE-2018-0802.

DETECT (DE) – Monitoring & Analysis

Command
Query EDR for anomalous child processes spawned by Microsoft Office applications, specifically PowerShell or HTA executions.

Command
Monitor egress network traffic for connections to "berlin101.com" over TCP port 6000.

RESPOND (RS) – Mitigation & Containment

Command
Isolate endpoints exhibiting process hollowing into "Msbuild.exe".

Command
Block the identified C2 domain and port at the perimeter firewall.

RECOVER (RC) – Restoration & Trust

Command
Reimage confirmed compromised hosts from known-good backups.

Command
Validate clean state prior to phased network restoration.

IDENTIFY & PROTECT (ID/PR) – The Feedback Loop

Command
Implement application control to prevent Office applications from creating executable artifacts or launching script interpreters.

Remediation - THE HOME USER TRACK (Safety Focus)

Priority 1: Safety

Command
Disconnect from the internet immediately.

(Note: Only execute this command if the Environmental Reality Check confirms Microsoft Office is manually installed on your machine. If it is not installed, the threat level is Theoretical/Low).

Command
Do not log into banking/email until verified clean.

Priority 2: Identity

Command
Reset passwords/MFA using a known clean device (e.g., phone on 5G).

Priority 3: Persistence

Command
Check Scheduled Tasks, Startup Folders, and Browser Extensions for unknown entries.

Hardening & References

Baseline
CIS Benchmarks for Microsoft Office (Disable macros, enforce Protected View). Historically, Microsoft Office flaws account for nearly 80% of malware attacks.

Framework
NIST CSF 2.0 / SP 800-61r3.

Source
Hackread

 

[Andy Ful]

Read full Story:

Hackers Use Excel Exploit to Hide XWorm 7.2 in JPEG Files, Hijack PCs

A new phishing campaign is spreading XWorm 7.2 via malicious Excel files, hiding malware in Windows processes to steal passwords and Wi-Fi keys.

hackread.com

It uses 8 years old exploit, but there are still many people who use pirated (not updated) older versions of MS Office.
When using MD, the attack can be successfully mitigated by the ASR rule related to blocking child processes of office applications or by blocking outbound connections of PowerShell.
MS Office 2007 and later versions were patched in the year 2018.

 

[bob007]

recently I captured many Xworm campaigns. its rating is going up.

 

[bob007]

recently I captured many Xworm campaigns. its rating is going up.

older version than this one. v3.1 v5.6 etc.

 

[Halp2001]

To complement the information about XWorm campaigns, here’s a simple overview of how this malware has evolved over time:

• XWorm 3.1 (~2022): this was an early version, fairly basic. Attackers could control the computer remotely, steal files, and log keystrokes. Its main weakness was that traditional antivirus tools could detect it more easily. It was usually spread through phishing emails with attached documents.
• XWorm 5.6 (2023–2024): this version became more dangerous. It could steal credentials, connect to multiple command‑and‑control servers, and even include ransomware functions. However, its builder had a flaw that allowed researchers to block its control panel. Attackers often delivered it through financial‑themed emails and multi‑layered loaders.
• XWorm 7.2 (2025–2026): the most advanced version so far. It hides malicious code inside JPEG images (a technique called steganography), exploits old Excel vulnerabilities combined with PowerShell, and targets Wi‑Fi keys, messaging accounts, and cryptocurrency wallets. It’s much harder to detect and uses persistence techniques to stay active on the system.

In short, XWorm has gone from being a relatively simple trojan to a sophisticated threat that keeps evolving and expanding its targets.

 

[Andy Ful]

Would ASR rule "Block all Office applications from creating child processes" stop running the hidden HTA, and constrained language mode stop PS download of file?

The parent process is Eqnedt32.exe. If I correctly recall, this executable is not considered by ASR rules as the MS Office application.
After the update from 2018, the Eqnedt32.exe was removed from MS Office 2007 and later versions. The attack can still be successful on unupdated versions of MS Office 2007, 2010, 2013, and 2016 (often pirated Windows or MS Office) or when users install it for compatibility with old documents.
The Eqnedt32.exe is not included in the currently supported versions of MS Office.

The attack from the OP can be simply mitigated at home by blocking the outbound connections of popular LOLBins (like PowerShell). However, using the unupdated MS Office is not reasonable.

 

[Parkinsond]

The attack from the OP can be simply mitigated at home by blocking the outbound connections of popular LOLBins (like PowerShell)

I was under-estimating the role of FW in mitigation of several attacks before reading your analyses of the variable attack methods.