{"id":18515,"date":"2026-02-17T11:09:32","date_gmt":"2026-02-17T11:09:32","guid":{"rendered":"\/cybersecurity-blog\/?p=18515"},"modified":"2026-02-26T09:39:30","modified_gmt":"2026-02-26T09:39:30","slug":"xworm-latam-campaign","status":"publish","type":"post","link":"https:\/\/any.run\/cybersecurity-blog\/xworm-latam-campaign\/","title":{"rendered":"LATAM Businesses Hit by\u00a0XWorm\u00a0via Fake Financial Receipts: Full Campaign Analysis\u00a0"},"content":{"rendered":"\n

Editor\u2019s note:<\/strong> The current article is authored by Moises Cerqueira, malware researcher and threat hunter. You can find Moises on LinkedIn<\/a><\/em>.<\/p>\n\n\n\n

Malware campaigns targeting Latin America (LATAM) are evolving. While the final payloads, often commodity RATs like XWorm<\/a>, remain consistent, delivery mechanisms are becoming increasingly sophisticated to bypass region-specific defenses and increase the chance of reaching real business users. <\/p>\n\n\n\n

In this analysis, we dissect a recent campaign targeting Brazilian users. What starts as a deceptive \u201cbanking receipt\u201d<\/strong> quickly turns into a multi-stage infection chain that\u00a0leverages\u00a0steganography,\u00a0Cloudinary abuse, and a dedicated .NET persistence module designed to bypass traditional\u00a0schtasks\u00a0monitoring, reducing early visibility for security teams and prolonging dwell time.\u00a0<\/p>\n\n\n

\n
\"\"
Complete infection chain from WScript execution to CasPol injection<\/em><\/figcaption><\/figure><\/div>\n\n\n

Key Takeaways <\/h2>\n\n\n\n

Built to blend into finance workflows: <\/strong>A \u201creceipt\u201d lure is optimized for real corporate inboxes and shared drives across LATAM.<\/p>\n\n\n\n

High click potential in real operations: <\/strong>Payment and receipt themes map to everyday processes, which raises the chance of execution on work machines.<\/p>\n\n\n\n

The chain is designed to stay quiet: <\/strong>WMI execution, fileless loading, and .NET-based persistence reduce early detection signals and increase dwell time. <\/p>\n\n\n\n

One endpoint can become an identity problem: <\/strong>XWorm access can lead to credential\/session theft and downstream compromise of email, SaaS, and finance systems. <\/p>\n\n\n\n

Trusted services and binaries are part of the evasion: <\/strong>Cloud-hosted payload delivery and CasPol.exe abuse help the activity blend in.<\/p>\n\n\n\n

Early detection is an operational advantage: <\/strong>Better monitoring + faster triage + regional hunting<\/a> can keep his attack from escalating into fraud, data exposure, or ransomware.
<\/p>\n\n\n\n\n

\n\n

\n74% of Fortune 100 companies \n<\/span>rely on ANY.RUN
for earlier detection and faster SOC<\/span> response \n  \n<\/p>\n\n\nPower your SOC now\n<\/a>\n<\/div>\n\n\n\n