Executive Summary
XWorm has emerged as a top-tier global threat in the Malware-as-a-Service (MaaS) market, reaching the #3 global threat ranking in 2025 with a 174% surge in detections. Recent campaigns target entities, including a Taiwan-based network security company, using Version 7.1 of the RAT which features enhanced stealth and modularity.
The attack chain has evolved from simple executables to a sophisticated multi-stage process involving JS droppers, encrypted PowerShell scripts, and the weaponization of WinRAR vulnerability CVE-2025-8088 via Discord. The malware employs 'Living-off-the-Land' (LotL) tactics by hijacking legitimate Microsoft binaries like Aspnet_compiler.exe to host its malicious payload in memory.
This shift from predictable file-based execution to memory-resident techniques effectively neutralizes signature-based defenses. The combination of low-cost accessibility ($500 lifetime subscription) and high-impact enterprise disruption makes XWorm a critical risk for security teams to monitor and mitigate through behavioral-based detection.