Attack chain leads to XWORM and AGENTTESLA

As cited

Copy frozen at 2026-09-20 03:00 UTC (site build).

threat intel

Attack chain leads to XWORM and AGENTTESLA

A multi-stage malware campaign uses deceptive documents to trick users into initiating an attack chain that delivers XWORM and AGENTTESLA payloads. The campaign leverages social engineering to appear legitimate and lower user defenses.

Why it matters: Organizations and users are at risk from document-based delivery mechanisms; security teams should warn staff about suspicious files and consider blocking or sandboxing Office documents from untrusted sources.

Source published

2023-04-10 00:00 UTC

First seen by Cybersecurity Tracker

2026-09-20 00:53 UTC