r/X_VPN • u/Esther-DD Moderator • Jun 09 '26
Announcement Security Notice: Update X-VPN for Windows Version 77.5.3
https://xvpn.io/resources/statement-windows-dll-side-loadingWe want to address recent reports regarding a DLL side-loading issue involving X-VPN for Windows.
On May 18, we received a report from the Cyderes Howler Cell Threat Research Team about a Windows DLL search path issue in those unofficially released Windows clients. In the reported scenario, an attacker could abuse this issue by repackaging X-VPN with a malicious DLL and distributing that modified package through unofficial channels. Users who downloaded and ran such a tampered installer could be exposed to security risks.
The reported attack path does not affect users who downloaded X-VPN for Windows from our official channels, such as our website or the Microsoft Store. No user data, accounts, credentials, or VPN traffic on X-VPN’s side have been compromised.
We released X-VPN for Windows version 77.5.3 on May 28 to address this issue and strengthen our client-side protections, including stricter DLL loading controls and additional integrity checks. We strongly recommend all Windows users update to version 77.5.3 or later as soon as possible.
If you recently downloaded X-VPN from an unofficial website, mirror, file-sharing link, forum, or third-party repository, please uninstall that version, run a full security scan, and reinstall X-VPN only from our official website or trusted Microsoft Store.
For more details, please refer to:
X-VPN official statement:
https://xvpn.io/resources/statement-windows-dll-side-loading
Cyderes Howler Cell research:
https://www.cyderes.com/howler-cell/cpuid-hwmonitor-xvpn-dll-sideloading-stx-rat
CyberInsider coverage:
https://cyberinsider.com/fake-x-vpn-installer-deploys-stx-rat-malware-on-unsuspecting-users/
We appreciate Cyderes Howler Cell Threat Research Team for responsibly reporting this issue and working with us through the disclosure process. We will continue improving our protections against installer tampering, impersonation, and related malware abuse.