XLoader campaign hides credential stealer using LuaJIT and Windows process injection
MALWAREAgent Teslaredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
A new XLoader infection chain hides the credential stealer inside an embedded LuaJIT interpreter, then moves it into another Windows process using shared-section injection. The campaign uses business-themed lures, including order and payment emails, with one Greek-language message noted. It has also been used to deliver Agent Tesla, Remcos and XWorm.
For IT people · Written by AI from 1 source · Wrong?
What to do
- No action needed.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
GBHackers