XWorm RAT is expanding from an information stealer into a broader surveillance platform, with new plugins that can track a victim’s location, stream live microphone audio and interact with browser sessions that are already authenticated. Netskope Threat Labs documented the changes in a report published October 12. Netskope’s analysis says four XWorm versions are circulating in the wild.
The modular malware supported 35 plugins in July 2025; that total has risen to 46 in October 2026, according to the research. The additions include Maps, Microphone and HBrowser, alongside existing functionality for keylogging, screen capture, webcam access, remote desktop control, file theft and command execution. Netskope recorded 1,236 XWorm detection events across more than 100 customer organizations during the third quarter, four times the volume reported for the same period in 2025.
HBrowser presents the most consequential change for account security. It gives an operator an interactive view of a selected browser and relays keyboard, mouse, scrolling and pasted-text input through XWorm’s encrypted command-and-control channel. Because the activity occurs inside a session the victim has already authenticated, the attacker may reach accessible accounts without obtaining the user’s password or completing a new multifactor-authentication challenge. That is better understood as session hijacking than as a cryptographic bypass of MFA.
The Maps plugin requests Windows location data after changing the system’s location-consent setting, potentially suppressing the normal user prompt. Netskope said it can send GPS coordinates to the operator and fall back to IP-based geolocation when satellite data is unavailable. The Microphone plugin enumerates recording devices and captures audio through the Windows host, while webcam capture remains available on demand. These capabilities allow surveillance without the privilege escalation or visible warning that defenders might expect from a conventional spyware workflow.
Netskope attributed the rising activity in part to the mid-2025 leak of the XWorm 6.4 builder, which lowered the barrier for other operators to create samples and helped keep detections above pre-leak levels. The research identified versions 6.4, 6.5, 7.2 and 7.4 operating concurrently, but did not tie the campaign to a named threat group. XWorm is malware rather than a software vulnerability, so there is no associated CVE, vendor patch or CVSS score to apply.
Defenders should treat XWorm detections as potential hands-on-keyboard intrusions rather than isolated credential-theft events. Endpoint teams should hunt for XWorm loaders and plugin activity, review browser-session and identity-provider logs for unusual actions from trusted devices, and revoke active sessions and tokens after suspected compromise. Organizations should also restrict unapproved executable and script delivery, monitor microphone, webcam and location access, and use endpoint and network detections informed by the technical findings in Netskope’s report.
