The Wix-Vercel Weapon: Unmasking the High Severity XWORM Attack Shredding the Modern Perimeter

The modern perimeter isn't a firewall; it's a social contract. We have been conditioned to believe that content served from the world's leading cloud platforms is inherently safe. We trust Wix. We trust Vercel. And in the 2025 tax season, the XWORM Remote Access Trojan (RAT) just tore that contract up.

Recent analysis has uncovered a sophisticated campaign targeting tax-related anxieties with surgical precision. This isn't your run-of-the-mill phishing attempt; it is a high severity event. By weaponizing the very infrastructure that powers the modern web, attackers are bypassing the traditional "check the domain" logic that security teams have relied on for a decade. We are now witnessing the "unmasking" of a threat that turns reputable Content Delivery Networks (CDNs) into launchpads for total system compromise.

The ShareFile Mimicry: Your Favorite Cloud Services are Being Weaponized

The first line of defense in most organizations is a reputation-based filter. Attackers have effectively neutralized this by hosting their initial lures on reputable cloud platforms that security filters are hesitant to block. This campaign specifically leverages sf-notification.vercel.app — a landing page meticulously designed to mimic a legitimate ShareFile notification (?app.sharefile.io).

Once the victim is lured to this trusted Vercel endpoint, the site triggers a direct download from the Wix Media CDN (download-files.wixmp.com). This is a tactical masterstroke. By using Wix and Vercel, the attackers exploit a massive "trust gap" in modern cloud infrastructure. Security perimeters typically white-list or deprioritize traffic from these reputable endpoints, allowing the malicious traffic to flow into the heart of the network unchallenged.

The "Lily Stewart" Lure and the 23.3 MB Payload

The attack begins with a classic social engineering hook: a file purportedly containing tax documents from a "Lily Stewart." However, the file is a masterpiece of deception. Named Lily_Stewart_Tax_Documents_2025.pdf .js, it utilizes an extreme amount of whitespace padding to hide its true nature. On a standard Windows system, the .js extension is truncated, leaving the user to believe they are opening a benign PDF.

But the real technical anomaly is the file size. This JavaScript stager is a staggering 23.3 MB. This is an extraordinary size for a script and is a deliberate tactic used to bypass certain sandbox file-size limits that are optimized for smaller script files. This massive footprint is necessary because the script serves as a heavy-duty container for the obfuscated payload that will eventually be injected into system memory.

The danger of this simple trick is succinctly captured by the threat intelligence community:

"Tax-themed phishing campaigns continue to leverage trusted cloud infrastructure to bypass perimeter filters and drop persistent payloads."

Living Off the Land: The Multi-Stage Execution Chain

Once the user double-clicks the script, the malware initiates a "Living off the Land" strategy. Rather than running unrecognized executable code — which would likely trigger an EDR alert — it hijacks legitimate, trusted Windows binaries (LOLBins) to manage the infection.

The process ancestry follows a calculated handoff:

1. chrome.exe: The initial entry point where the user interacts with the Vercel-hosted ShareFile lure.
2. wscript.exe: The Windows Script Host is invoked to parse and run the massive 23.3 MB obfuscated JavaScript.
3. powershell.exe: Wscript spawns PowerShell, which acts as the primary engine for the loader.

PowerShell isn't just profiling the system; it is executing the secondary stager scripts dropped into %APPDATA%\Local\Temp\, specifically tmslpw.ps1 and zaigtj.ps1. By hiding within these trusted system tools, the malware cloaks its activity within the noise of standard system operations.

Stealth Through Memory Injection and Fileless Execution

To evade traditional antivirus software that scans files as they are written to disk, XWORM employs a "fileless" approach for its final payload. The 23.3 MB JavaScript file contains the encoded XWORM binary, which is decoded and executed directly in the system's volatile RAM.

Because the core of the malware never touches the disk as a traditional executable, there is no signature for legacy scanners to find. This makes post-infection cleanup a nightmare for IT teams; there is no malicious application to uninstall. The threat lives in the memory of the machine, essentially becoming a ghost in the wires that survives as long as the process remains active.

The Persistence Loop

For XWORM, execution is only half the battle. To ensure the infection survives a system reboot, the malware modifies the Windows Registry to establish a permanent foothold. It adds a persistent entry to the path: HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Summary: The New Perimeter is You

The XWORM campaign proves that technical filters are no longer a silver bullet. Survival in this landscape requires a fundamental shift in defensive posture. Organizations must move beyond domain reputation to strict execution policies. This means enforcing AppLocker or Software Restriction Policies (SRP) to block the execution of .ps1 and .js files from the %APPDATA%\Local\Temp directory and strictly monitoring scripting hosts like wscript.exe when they attempt to spawn PowerShell with hidden execution flags.

we have to face a hard reality: If we can no longer trust the domains we use every day, how must our personal "security perimeter" evolve to survive?