XWorm Attack Chain: JavaScript, PowerShell, Reflective .NET Loader 10.09.2026 The XWorm chain, from an obfuscated JavaScript dropper through PowerShell to a reflective loader that injects into MSBuild. XWORM javascript powershell .NET reflective-loading deobfuscation
Fileless .NET DLL - RAT 06.07.2026 A javascript file that stages Powershell and extracts a malicous .NET Dll from an image. XWORM Powershell .NET javascript Steganography