October 14, 2026
- XWorm has grown from infostealer into a surveillance platform, with an expanded plugin set covering location tracking, live audio streaming and interaction with authenticated browser sessions (Netskope Threat Labs, SecurityWeek).
· Threat Activity
in Three Chained Zero-Days Put Root on a Fully Patched Ivanti VPN
October 1, 2026
- 2CLoader, a loader Zscaler ThreatLabz identified in August 2026, distributes Vidar, Remus and XWorm using indirect syscalls, anti-analysis checks and Windows API hooking; the write-up covers configuration, payload decryption and C2 (Zscaler).
· Threat Intelligence
in An Encoded Character Away From Admin: Cisco SD-WAN Manager Exploited in the Wild
August 13, 2026
- A new "SaassyCode" campaign is pushing malicious VS Code extensions: Nextron's scanner flagged "Trello Board" (TrelloWorks.trello-board), which downloads and runs a BAT loader on startup, sets scheduled-task persistence, and injects shellcode into trusted Windows processes — part of the same wave of Marketplace abuse that has also carried XWorm, per Knostic's analysis.
· Threat Activity
in ShieldBreak Turns a "Patched" Defender Bug Back Into SYSTEM
August 12, 2026
- A threat actor keeps pushing XWorm-laden extensions to the VS Code Marketplace. One activated at startup, claimed it needed elevated permissions to "sync board data securely," relaunched VS Code as admin, then added Defender exclusions and pulled a PowerShell stager to drop a fake
svchost.exe (Nextron gist).
· Threat Activity
in When the AI Is the One Finding the Zero-Days