The campaign exploits an Office vulnerability to deliver the modular XWorm RAT, chaining HTA, PowerShell, and in-memory .NET execution to sidestep detection and expand post-compromise control.
Microsoft warns that Python-based infostealers are increasingly targeting macOS, harvesting sensitive data and challenging ...