XWorm RAT gains live audio, location tracking and browser hijacking plugins

XWorm, a Windows remote access trojan (RAT) first seen in 2022, has evolved into a broader surveillance platform with new plugins for live audio, location tracking and browser session hijacking, according to research from Netskope reported by SecurityWeek on October 13. The researchers say the malware has been increasingly active this year, a trend they link to leaks of its builder and source code.

What happened

In a report titled "XWorm Reborn," Netskope says it observed more than 1,200 XWorm incidents across 100 organizations in the third quarter of 2026. According to SecurityWeek, Netskope attributes the increased activity to two leaks: a cracked XWorm builder was released publicly in June 2025, and the source code for version 6.4 leaked in August 2025. These leaks lowered the barrier for other threat actors to build and customize their own variants.

The researchers found that the number of plugins supported by XWorm grew from 35 in July 2025 to 46 in October 2026.

Technical details

XWorm already offered standard RAT capabilities such as keylogging, screenshot capture, webcam access and payload execution. According to SecurityWeek, Netskope highlights several newer plugins:

• Maps: returns the victim's GPS location without prompting the user.
• Microphone: streams live audio from the infected device.
• HBrowser: gives the operator a real-time view of the victim's browser and relays the attacker's input. Netskope says this lets attackers use already authenticated sessions without stealing credentials, effectively bypassing multi-factor authentication.
• Webcam capture: available on demand.

Netskope notes that the Maps and Microphone plugins can run without privilege escalation and without displaying a warning to the user.

The SecurityWeek report does not describe how XWorm is delivered in current campaigns, which industries or regions are targeted, or any indicators of compromise. Netskope's original research contains these technical details.

Who is affected

XWorm targets Windows systems. Because its builder and source code are publicly available, it is used by many different operators rather than a single group, which makes the targets varied. The browser takeover capability is particularly concerning for organizations that rely on MFA-protected web applications, since an attacker operating inside a live session does not need to defeat the second factor.

What to do

Security teams should make sure endpoint protection detects XWorm and its plugins, and should review Netskope's published indicators. Unexpected processes accessing the microphone, webcam or location services should be investigated. Shortening session lifetimes for sensitive web applications, binding sessions to devices where possible and monitoring for unusual session activity can limit the impact of browser hijacking. Users should continue to be warned about untrusted attachments and downloads, which commonly deliver commodity RATs.