.jpg){kind=link}
Remote access trojan (RAT) XWorm has developed into an advanced surveillance threat whose capabilities extend beyond data theft and remote system control. According to cyber security researchers at Netskope Threat Labs, recent versions of this malware contain plugins for tracking the location of victims, capturing live audio, controlling webcams, and controlling active browser sessions.
It was discovered in 2022 that XWorm facilitated the control of compromised systems by logging keystrokes, capturing screenshots, and executing remote payloads. The malware has been modified by its developers since its discovery, adding new features and releasing updated versions.
According to Netskope, 1,236 detection events were recorded across 100 customer organisations during the third quarter of 2026, representing a fourfold increase from the same period in 2025.
The malware's expansion has been accompanied by an expansion of its plugin collection. In July 2025, 35 plugins were supported, but by October 2026, 46 plugins were supported, which provided increased capabilities for monitoring and interacting with victims' devices.
A cracking of the XWorm builder and subsequent release of the source code for version 6.4 in August 2025 resulted in the wider dissemination of the malware. Since then, researchers have identified multiple versions operating in the wild, including V6.4, V6.5, V7.2, and V7.4 The malware has been modified in several ways, including code protection, delivery methods, and the ability to evade security analysis.
There are approximately 35% of affected customers that are affiliated with financial services companies, according to Netskope. The majority of reported incidents have occurred in the United States, India, Brazil, Italy, Panama, and Brazil.
HBrowser plugins pose a significant security risk due to their ability to operate within existing browser sessions rather than relying on stolen passwords.
Command-and-control channels of the malware are encrypted using AES, allowing for remote mouse clicks, keyboard inputs, and other interactions with the active browser.
By continuously taking screenshots, attackers can gain access to accounts already logged in and potentially gain access to sensitive information. By collecting device location data without a visible consent request, the Maps plugin adds another layer of surveillance.
Netskope's analysis shows that it attempts to retrieve GPS coordinates, but when GPS coordinates are not available, it switches to IP-based geolocation.
Microphone plugins allow for recording audio from selected recording devices and transmission to operators in encrypted, compressed data chunks. In addition to webcam recording, attackers may also monitor compromised devices without displaying obvious warnings to the user using these functions.
Continued Development Raises Security Concerns
As the malware has evolved, it has also undergone changes to make analysis and detection more challenging. Recent variants have introduced stronger code protection techniques, techniques for avoiding virtual analysis environments, and modifications to payload delivery and command-and-control communication.
By expanding the plugin collection, operators have increased the range of options they have for tailoring attacks to meet their objectives.
NetSkope anticipates continued development of XWorm following the public release of its builder and source code, with further development likely following that. The increasing surveillance capabilities of malware also highlight the limitations associated with multi-factor authentication alone.
An attacker who controls an already authenticated browser session on an infected device may not be able to prevent access to open accounts even when additional login verification is performed.
It is recommended that security teams strengthen endpoint monitoring, investigate unusual process and network activity, and restrict unauthorised outbound communications.
Network segmentation will also allow you to limit the spread of malware across other connected systems.
Detecting endpoints, monitoring traffic, and responding to incidents in a timely manner remain crucial for identifying suspicious activity and containing compromised devices before they can be exploited further by attackers.
Read the original article: