johnsonsvalves.cam: a Windows XWorm malware site that hides code in a PNG, and what to do if a script from it ran

What johnsonsvalves.cam is, and what we know about it

johnsonsvalves.cam is a web address, not a program on your PC. It is a domain that the abuse.ch project URLhaus lists as a place where malware was served, and two of its three entries carry the tag xworm. No public write-up of this one domain exists that we could find, so this page rests on what URLhaus shows, what we saw ourselves and what researchers have published about XWorm delivered through pictures.

1. 1

   What URLhaus lists

   Three file addresses on johnsonsvalves.cam, all added on 30 September 2026 by the abuse.ch reporter account. At 10:02 UTC came http://johnsonsvalves[.]cam/HF1W1Z5K with the tags ascii, powershell, ps1 and xworm, and https://johnsonsvalves[.]cam/img_215919.png with the tags stego and xworm. At 15:04 UTC came http://johnsonsvalves[.]cam/luFiVL08 with no tags. All three carry the threat type malware_download and were offline when we read them.

2. 2

   What the tags mean

   ps1 and powershell say that the first file is a PowerShell script. ascii says it is plain text, not a compiled program. xworm names the malware family: XWorm is a remote access tool, a program that lets another person control a PC. stego says that the PNG picture hides data inside it. Together they describe a script that fetches a picture and pulls a program out of it.

3. 3

   What we could not confirm

   We did not download any of the files and we never saw a page that tells visitors what to do. So we do not know how a victim reached the script, what exactly the picture holds, or what the third file is. The tags are the reporter's labels, not our finding.

4. 4

   What this means for you

   If you only saw the name in a log, a link or a warning, you are not infected by that alone. The risk is for people who opened a script file that reached out to this address, pasted a command that did, or ran a file that came from it.

Kind of threat

A malware download address; two entries are tagged xworm, one of them a PNG tagged stego

Malware family

XWorm, a remote access tool for Windows (reporter's tag, not confirmed by us)

Domain registered

26 May 2026, expires 26 May 2027, registrar NameCheap, Inc.; record last changed 30 September 2026 (RDAP, read 10 October 2026)

URLhaus entries

3 file addresses, all added on 30 September 2026; all 3 offline when we read them

Platform

Windows, by the ps1 tag. No source says which other systems are hit

What we checked on 10 October 2026, and what we could not

We tried to open https://johnsonsvalves.cam/ once, from Lithuania, in an automated Chromium browser set to English. The browser reported that the name could not be found, so no page loaded. That tells you nothing good about the site and it clears nothing.

What happened to johnsonsvalves.cam, from registration to our test

The history is short: the domain is under five months old and all three malware addresses were reported on one day. The dates come from RDAP and from the URLhaus database.

1. 26 May 2026

   The domain is registered

   RDAP shows johnsonsvalves.cam registered on 26 May 2026 through the registrar NameCheap, Inc., valid until 26 May 2027. The name sounds like a valve maker; nothing we found shows a real business behind it.

2. 30 September 2026

   A script and a picture are reported

   At about 10:02 UTC URLhaus receives two entries from abuse.ch: the script HF1W1Z5K, tagged ascii, powershell, ps1 and xworm, and the picture img_215919.png, tagged stego and xworm. This is the first time URLhaus sees the host.

   

3. 30 September 2026

   A third file and a record change

   At 15:04 UTC a third file, luFiVL08, is added with no tags. The same day RDAP shows the registration record changed. We do not know what was changed or why.

4. 10 October 2026

   Our test finds no address

   Our browser visit to https://johnsonsvalves.cam/ ends in ERR_NAME_NOT_RESOLVED, and URLhaus shows all three files offline.

We could not read the URLhaus pages themselves, because they ask for a browser check. The entries above come from the same data in our own database, which holds the URLhaus feed.

How malware can hide in a picture, and what XWorm is

We did not see what johnsonsvalves.cam's picture holds. This is how security researchers describe the same method in other XWorm campaigns, so you can recognise the pattern.

1. 1

   A script file starts the chain

   AhnLab's analysis says a phishing email delivers a VBScript or JavaScript file. The first script inserts a PowerShell script that holds Base64 text mixed with filler characters, removes the filler, decodes the rest and runs it.

2. 2

   PowerShell fetches a picture

   That PowerShell downloads a JPG image from an outside server. The image opens as a normal picture, so a person who looked at it would see nothing wrong.

3. 3

   The program is read out of the picture data

   AhnLab describes two versions. In the older one, Base64 text sat between two markers at the end of the image. In the newer one, the script finds a bitmap signature at the end of the JPG and reads the red, green and blue values of its pixels to rebuild a .NET loader.

4. 4

   The loader starts XWorm

   The rebuilt loader runs and starts the final malware. ANY.RUN describes another chain in which the files named Vile.png and Mands.png in C:\Users\PUBLIC are not pictures at all but encrypted data, which a two-stage PowerShell loader decrypts and loads straight into memory.

The point of the trick is that no ordinary installer file ever lands on the disk, and a PNG or JPG looks harmless to a quick filter. It does not mean the picture on your screen is dangerous to view. The danger is the script that reads the picture and runs what it finds.

XWorm itself is a remote access tool. That is a program that connects out to a server run by the attacker and then takes orders, which is why this page tells you to disconnect the PC before anything else. We did not analyse a sample, and we found no first-hand analysis of the johnsonsvalves.cam files, so we do not list its commands or settings here.

The three files: what each name suggests, and what we do not know

File names are weak evidence. We list what each one could be and mark which statements are only a reading of the name and tags.

Random eight-character names with no file ending are typical of servers that serve a different file to each request path, but that is a habit, not proof. We did not fetch the files, so we cannot say how the three belong together.

What a remote access tool like XWorm can mean for you

We did not open the files and found no analysis of them, so we cannot list what this copy does. The table below is the general meaning of a remote access tool, not a claim about this site's file.

What this can cost you

Reading the site name or seeing a warning costs nothing. The risks below apply to a PC where a script from the site ran or a file from it was opened.

• High

  Someone else controlling the PC

  If XWorm ran, a person may be able to reach the PC from outside. Disconnect it from the network first, before you change any password on it.

• High

  Passwords and sessions typed or saved on the PC

  A remote tool can see what you type and what your browser holds. Change passwords from another device and sign out of your accounts everywhere, because a new password alone may not end a stolen session.

• High

  Crypto theft

  Wallet files and recovery phrases on an infected PC should be treated as exposed. Stolen crypto cannot be reversed, so move funds to a new wallet made on a clean device before you do anything else on the PC.

• Medium

  A hidden program that starts again

  ANY.RUN describes a scheduled task that re-runs the loader. Until that is found and removed, the PC may keep contacting the attackers after a restart.

• Medium

  Work accounts and company data

  On a work PC the saved logins reach company systems. Tell your IT or security team at once; they can block the accounts.

• Low

  Nothing, if you only saw the name

  A name in a warning, a firewall log or a blocked link is not an infection.

What you may notice, and what you may not

Many victims notice nothing. The signs below follow from how these chains are built; the first three are the best evidence you have.

How people end up running a script like this

We do not know how visitors reached johnsonsvalves.cam, and no source says. AhnLab names one route for the image method in general: an email that carries a script file.

1. 1

   An email with a script attachment

   AhnLab says the chain begins with a phishing email that delivers a VBScript or JavaScript file. The file may be named like an order, an invoice or a document.

2. 2

   A script or archive from a web page

   ANY.RUN describes a JavaScript file named like a purchase order that came by email and web pages. Opening it runs it; Windows does not treat a .js file as a document.

3. 3

   A command you are told to paste

   Some pages ask you to copy a command into the Windows Run box or PowerShell to pass a check. The ps1 tag fits that way of starting a script, but no source tells us this site did so. We did not see its page.

4. 4

   A file that claims to be an update or a free program

   Cracked software and fake updates are common carriers for remote tools. This is general knowledge, not something we saw on this domain.

Check your Windows PC before you delete anything

Start with the question that matters: did you open a script file or paste a command that fetched something from johnsonsvalves.cam, or run a file that came from it? If yes, follow the numbered plan on this page, because a clean-looking check does not clear a PC. If you are not sure, do these checks first. None of them deletes anything.

While you check, stop using the PC for banking, email, work or crypto, and disconnect it from Wi-Fi and network cables if you can.

1. 1

   Look in C:\Users\Public

   Open File Explorer and go to C:\Users\Public. ANY.RUN found staging files there in an XWorm chain: a batch file, and two files ending in .png that were not pictures. Look for files you did not put there. If a .png will not open in Photos, note its name and do not delete it yet.

2. 2

   Look for a scheduled task you did not make

   Press the Windows key, type Task Scheduler and open it. Select Task Scheduler Library and read the names and the Actions tab of any task that is new or has a random name. Do not delete anything yet; note the name.

3. 3

   Look in the Startup folder

   Press Windows key + R, type shell:startup and press Enter. A file you did not put there is a reason for doubt. Note it.

4. 4

   Read the Run box history if you pasted a command

   Open Registry Editor (press the Windows key, type regedit, press Enter) and go to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU. Each value is a line typed into Run. Look at it, do not run it, and write down any line that contains powershell, a web address or johnsonsvalves.

5. 5

   Check Windows Security

   Open Windows Security > Virus & threat protection > Protection history. On Windows 10 the same page is under Settings > Update & Security > Windows Security. Look for detections dated around the time the script ran.

6. 6

   Remember what a clean check means

   The chain is built to run from memory, so it may leave little on the disk. A clean check lowers the doubt; it does not remove it.

Scan from outside Windows: Microsoft Defender Offline

An offline scan runs before the normal Windows starts, so a hidden program cannot hide from it as easily. Microsoft's page says it targets malware that tries to bypass the Windows shell, such as rootkits.

1. 1

   Prepare

   Save your work and close programs. Microsoft says the scan takes about 15 minutes and restarts the PC. You must be signed in as a local administrator and Windows Recovery Environment must be on. To check, open a Command Prompt as administrator and run reagentc /info; if it says Disabled, run reagentc /enable. Microsoft notes that if it is off, the scan simply does not run and shows no error.

2. 2

   Suspend BitLocker if it is on

   If BitLocker protects the system drive, suspend it first. Otherwise the PC may ask for your recovery key when it restarts into the offline scan.

3. 3

   Start the scan

   Open Windows Security > Virus & threat protection > Scan options. Choose Microsoft Defender Offline scan and select Scan now. Agree to the prompts. The PC signs you out, restarts into the scan and starts Windows again when it ends. In PowerShell as administrator, the command Start-MpWDOScan does the same.

4. 4

   Read the result

   Open Windows Security > Virus & threat protection > Protection history. Microsoft says the offline scan does not apply to Windows on ARM, and that Microsoft Defender Antivirus must be the main antivirus to receive its updates.

5. 5

   Do not stop there

   A scan that finds nothing does not prove the PC is clean if a remote access tool was running. If a script from this site ran, the safest end of the plan is still to back up documents and reinstall Windows.

If you use a Mac, an iPhone or an Android phone

The ps1 tag points at Windows. We found nothing that says the three files run on anything else.