XWorm RAT Evolves into Sophisticated Surveillance Platform with New Plugins
The XWorm Remote Access Trojan (RAT) has significantly expanded its capabilities with new plugins, transforming into a potent surveillance platform capable of tracking user location, streaming audio, and hijacking browser sessions.
The XWorm Remote Access Trojan (RAT), a multi-functional Windows malware first identified in 2022, has undergone a significant evolution, transforming into a sophisticated surveillance platform. Cybersecurity firm Netskope reports that developers have introduced new plugins that dramatically enhance the malware's espionage and data-gathering capabilities.
XWorm has consistently provided attackers with extensive control over infected systems, offering features such as keylogging, screenshot capture, webcam access, and the ability to execute arbitrary payloads. The malware's developers have actively maintained and expanded its codebase, ensuring its continued relevance and activity in the threat landscape. Netskope observed over 1,200 incidents involving XWorm across 100 organizations during the third quarter of 2026, highlighting its persistent threat.
A key aspect of this evolution is the substantial increase in the number of supported plugins. XWorm's plugin count has grown from 35 in July 2025 to 46 by October 2026. Several of these newly added plugins are specifically designed for advanced surveillance, enabling threat actors to monitor victims' locations, stream live audio, and even interfere with authenticated browser sessions.
Among the most concerning new plugins is 'HBrowser,' which allows attackers to hijack authenticated browser sessions without needing to steal credentials or bypass multi-factor authentication (MFA). This plugin provides operators with a real-time view of the victim's browser and can relay attacker inputs directly into the active browser window. Interactions are transmitted as commands over XWorm's AES-encrypted command-and-control (C&C) channel and executed on the victim's machine, effectively granting the attacker a full remote browser session.
Further enhancing its surveillance prowess, the 'Maps' plugin enables the malware to obtain victims' GPS locations without requiring user consent or prompt. Similarly, the 'Microphone' plugin allows for the live streaming of audio from the victim's device. These capabilities, along with on-demand webcam capture, can be deployed without requiring privilege escalation or alerting the user.
The increased activity surrounding XWorm is partly attributed to the public release of a cracked version of its builder in June 2025 and the subsequent leak of the RAT's source code for version 6.4 in August 2025. This availability has likely fueled further development and adoption by a wider range of threat actors.
Netskope anticipates continued upgrades and broader utilization of the XWorm toolkit due to these leaks. The malware's transformation into a comprehensive surveillance platform underscores a growing trend where sophisticated RATs are being weaponized for more targeted and intrusive espionage operations, moving beyond simple data theft to real-time monitoring and control.
The XWorm malware has seen a significant increase in detections, with 1,236 instances observed in Q3 2026, a fourfold rise compared to the previous year. Financial services remain a primary target, accounting for approximately 35% of affected customers, with notable activity in India, Brazil, Italy, Panama, and the United States. This latest report details the malware's expanded capabilities, including a new HBrowser plugin that allows attackers to directly control active browser sessions on infected Windows devices, bypassing the need for stolen credentials or MFA prompts.