How a leaked builder of XWorm turned a remote access trojan into a surveillance kit
Netskope says leaked XWorm builders turned the RAT into a surveillance kit with live browser, mic, and location plugins.
Netskope Threat Labs says four XWorm versions are active after a cracked builder leaked in June 2025 and modified V6.4 source leaked in August 2025. In Q3 2026 it logged 1,236 detections across more than 100 customer organizations, about four times Q3 2025, with roughly 35% of affected customers in financial services and activity concentrated in India, Brazil, Italy, Panama, and the United States. Known plugins grew from 35 to 46, including Maps, Microphone, and HBrowser, which relays a live browser session so operators can use already logged-in accounts without extracting credentials or defeating MFA. Newer builds add virtual-machine evasion, a rootkit, a dropper, and Windows monitoring bypasses.
- Four XWorm versions ran concurrently after the 2025 builder and V6.4 source leaks.
- Q3 2026 logged 1,236 detections at 100-plus organizations, four times Q3 2025.
- Financial services were about 35% of affected customers across five countries.
- HBrowser controls a live browser so open accounts need no stolen passwords or MFA bypass.
- Maps and Microphone collect location and audio without prompts or elevation.
From the original article
4 min read at securityaffairs.com
Netskope tracks four XWorm versions in the wild, 46 plugins, and new tools for location, audio and live browser control, with detections up fourfold. Netskope Threat Labs has been following XWorm since September 2024, and its latest report shows the malware has changed a lot. Over the past year the team identified four distinct versions […]
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.