Hackers Use Fake Court Notices to Deliver XWorm Malware Through Hidden Windows Scripts

Attackers are exploiting human trust by disguising malware delivery as legitimate court correspondence, a classic social engineering technique that bypasses technical controls by targeting user behavior. Once a victim executes the hidden Windows script embedded in the phishing email, XWorm grants attackers full remote access to the infected system, enabling data theft, lateral movement, and further compromise. The reuse of infrastructure across multiple campaigns (XWorm and DCRat) indicates a persistent and adaptive threat actor that iterates on proven tactics. This matters because a single click from an untrained employee can result in complete organizational compromise, regardless of how robust perimeter defenses are.