IT admins will be busy this month patching Microsoft software and apps, but not nearly as busy as they were in January.

The campaign exploits an Office vulnerability to deliver the modular XWorm RAT, chaining HTA, PowerShell, and in-memory .NET execution to sidestep detection and expand post-compromise control.