The campaign used a compromised Telegram account, a fake Zoom meeting, and AI-assisted deception to trick victims into ...
The campaign exploits an Office vulnerability to deliver the modular XWorm RAT, chaining HTA, PowerShell, and in-memory .NET execution to sidestep detection and expand post-compromise control.