Skip to content
XWorm RAT Transforms into Advanced Surveillance Tool

XWorm RAT Transforms into Advanced Surveillance Tool

First seen 13 Oct 2026, 13:29 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 14, 2026 at 08:29 UTC
  • •XWorm RAT has evolved to include 46 plugins, enhancing its surveillance capabilities.
  • •Over 1,200 incidents of XWorm were recorded in Q3 2026, marking a significant increase.
  • •The HBrowser plugin allows attackers to bypass MFA and gain control over browser sessions.

The XWorm Remote Access Trojan (RAT) has evolved into a sophisticated surveillance platform, according to cybersecurity firm Netskope. Initially identified in 2022, XWorm now includes 46 plugins, up from 35 in July 2025, enabling capabilities such as GPS location tracking, live audio streaming, and webcam access. Netskope recorded over 1,200 incidents involving XWorm across 100 organizations in Q3 2026, a significant increase attributed to the public leak of its builder and source code in mid-2025. The malware's new HBrowser plugin allows attackers to hijack authenticated browser sessions without requiring user credentials, effectively bypassing multi-factor authentication (MFA). The financial services sector is notably impacted, with activity concentrated in countries including India, Brazil, Italy, Panama, and the United States. Netskope warns that XWorm's evolution into a surveillance tool marks a concerning trend in malware development. The threat remains active, with ongoing updates expected as the toolkit continues to be utilized by attackers.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 7h ago How this analysis works

Timeline

2024-09-01
Netskope first reports on XWorm
Netskope Threat Labs disclosed details on XWorm and its infection chain.
threatlabs.netskope.com
2025-06-15
XWorm builder leaked publicly
The public leak of the XWorm V6.4 builder led to a surge in malware activity.
Securityweek
2025-08-01
Source code for XWorm V6.4 leaked
The source code leak contributed to the increased use and updates of XWorm.
Securityweek
2026-10-13
Netskope reports on XWorm's evolution
Netskope highlights the addition of surveillance capabilities to XWorm, including new plugins.
threatlabs.netskope.com

More articles in this cluster (5)

Following this threat?

Track XWorm in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (16)

1 / 3

Common questions

What new capabilities does XWorm have?
XWorm now includes plugins for GPS tracking, live audio streaming, webcam access, and browser session hijacking.
Which sectors are most affected by XWorm?
The financial services sector is particularly impacted, with significant activity noted in India, Brazil, Italy, Panama, and the United States.
How has XWorm's activity changed recently?
XWorm activity surged in Q3 2026, with over 1,200 incidents reported, largely due to the public leak of its builder and source code.