XWorm RAT Evolves Into Surveillance Platform

The XWorm RAT developers have expanded the malware’s capabilities with fresh plugins that turn it into a surveillance platform, cybersecurity firm Netskope reports. A sophisticated, multi-functional Windows RAT first observed in 2022, XWorm provides attackers with full control over the infected systems, offering keylogging, screenshot capture, webcam access, and payload execution capabilities. The malware’s developers have been constantly updating its codebase and adding new functionality, and the threat has remained highly active, with Netskope observing over 1,200 incidents across 100 organizations during the third quarter of the year. Alongside new variants, the developers have also increased the number of plugins XWorm supports, from 35 in July 2025 to 46 in October 2026. Some of these have been clearly designed for surveillance: enabling location tracking, live audio streaming, webcam capture, and interactive control over authenticated browser sessions. “The Maps plugin provides victims’ GPS location without a user prompt. The Microphone plugin streams live audio from the victim’s device. HBrowser hijacks authenticated browser sessions without touching credentials, bypassing MFA entirely. Webcam capture is also available on demand,” Netskope says . According to the cybersecurity company, the activity surrounding XWorm has increased since a cracked version of its builder was released publicly in June 2025, and the source code for RAT’s 6.4 version was leaked in August 2025. With the addition of the HBrowser plugin, the RAT moves beyond harvesting credentials and user data from browsers: it provides the operator with a real-time view of the browser and can relay attacker inputs to the browser. Operator’s interactions are encoded as command-and-control (C&C) commands, transmitted over the standard XWorm AES-encrypted communication channel, and executed on the victim’s system. “The victim machine receives them and executes the corresponding input on the active browser window. The operator receives a continuous stream of screenshots. From the operator’s perspective, it is a full remote browser session. Every authenticated tab is accessible, bypassing the need for logging in and dealing with MFA,” the company explains. The Maps and Microphone plugins allow operators to monitor the victim’s location and to capture audio without privilege escalation and without a user warning. “XWorm continues to evolve and has now added surveillance capabilities. Since its builder and source code were leaked, we expect continued upgrades and use of this toolkit,” Netskope notes. Related: Pre-Baked Firmware Malware Hits Budget Android Devices in 150+ Countries Related: US Disrupts Chinese State-Sponsored Hacking Tools Related: Linux Backdoor Abuses STUN Protocol, Exploits Dozens of Flaws Related: macOS Users Targeted by Fake Zoom Installer Carrying CloudSyncD Backdoor

A sophisticated, multi-functional Windows RAT first observed in 2022, XWorm provides attackers with full control over the infected systems, offering keylogging, screenshot capture, webcam access, and payload execution capabilities. The malware’s developers have been constantly updating its codebase and adding new functionality, and the threat has remained highly active, with Netskope observing over 1,200 incidents across 100 organizations during the third quarter of the year. Alongside new variants, the developers have also increased the number of plugins XWorm supports, from 35 in July 2025 to 46 in October 2026. Some of these have been clearly designed for surveillance: enabling location tracking, live audio streaming, webcam capture, and interactive control over authenticated browser sessions. “The Maps plugin provides victims’ GPS location without a user prompt. The Microphone plugin streams live audio from the victim’s device. HBrowser hijacks authenticated browser sessions without touching credentials, bypassing MFA entirely. Webcam capture is also available on demand,” Netskope says . According to the cybersecurity company, the activity surrounding XWorm has increased since a cracked version of its builder was released publicly in June 2025, and the source code for RAT’s 6.4 version was leaked in August 2025. With the addition of the HBrowser plugin, the RAT moves beyond harvesting credentials and user data from browsers: it provides the operator with a real-time view of the browser and can relay attacker inputs to the browser. Operator’s interactions are encoded as command-and-control (C&C) commands, transmitted over the standard XWorm AES-encrypted communication channel, and executed on the victim’s system. “The victim machine receives them and executes the corresponding input on the active browser window. The operator receives a continuous stream of screenshots. From the operator’s perspective, it is a full remote browser session. Every authenticated tab is accessible, bypassing the need for logging in and dealing with MFA,” the company explains. The Maps and Microphone plugins allow operators to monitor the victim’s location and to capture audio without privilege escalation and without a user warning. “XWorm continues to evolve and has now added surveillance capabilities. Since its builder and source code were leaked, we expect continued upgrades and use of this toolkit,” Netskope notes. Related: Pre-Baked Firmware Malware Hits Budget Android Devices in 150+ Countries Related: US Disrupts Chinese State-Sponsored Hacking Tools Related: Linux Backdoor Abuses STUN Protocol, Exploits Dozens of Flaws Related: macOS Users Targeted by Fake Zoom Installer Carrying CloudSyncD Backdoor

The malware’s developers have been constantly updating its codebase and adding new functionality, and the threat has remained highly active, with Netskope observing over 1,200 incidents across 100 organizations during the third quarter of the year. Alongside new variants, the developers have also increased the number of plugins XWorm supports, from 35 in July 2025 to 46 in October 2026. Some of these have been clearly designed for surveillance: enabling location tracking, live audio streaming, webcam capture, and interactive control over authenticated browser sessions. “The Maps plugin provides victims’ GPS location without a user prompt. The Microphone plugin streams live audio from the victim’s device. HBrowser hijacks authenticated browser sessions without touching credentials, bypassing MFA entirely. Webcam capture is also available on demand,” Netskope says . According to the cybersecurity company, the activity surrounding XWorm has increased since a cracked version of its builder was released publicly in June 2025, and the source code for RAT’s 6.4 version was leaked in August 2025. With the addition of the HBrowser plugin, the RAT moves beyond harvesting credentials and user data from browsers: it provides the operator with a real-time view of the browser and can relay attacker inputs to the browser. Operator’s interactions are encoded as command-and-control (C&C) commands, transmitted over the standard XWorm AES-encrypted communication channel, and executed on the victim’s system. “The victim machine receives them and executes the corresponding input on the active browser window. The operator receives a continuous stream of screenshots. From the operator’s perspective, it is a full remote browser session. Every authenticated tab is accessible, bypassing the need for logging in and dealing with MFA,” the company explains. The Maps and Microphone plugins allow operators to monitor the victim’s location and to capture audio without privilege escalation and without a user warning. “XWorm continues to evolve and has now added surveillance capabilities. Since its builder and source code were leaked, we expect continued upgrades and use of this toolkit,” Netskope notes. Related: Pre-Baked Firmware Malware Hits Budget Android Devices in 150+ Countries Related: US Disrupts Chinese State-Sponsored Hacking Tools Related: Linux Backdoor Abuses STUN Protocol, Exploits Dozens of Flaws Related: macOS Users Targeted by Fake Zoom Installer Carrying CloudSyncD Backdoor

Alongside new variants, the developers have also increased the number of plugins XWorm supports, from 35 in July 2025 to 46 in October 2026. Some of these have been clearly designed for surveillance: enabling location tracking, live audio streaming, webcam capture, and interactive control over authenticated browser sessions. “The Maps plugin provides victims’ GPS location without a user prompt. The Microphone plugin streams live audio from the victim’s device. HBrowser hijacks authenticated browser sessions without touching credentials, bypassing MFA entirely. Webcam capture is also available on demand,” Netskope says . According to the cybersecurity company, the activity surrounding XWorm has increased since a cracked version of its builder was released publicly in June 2025, and the source code for RAT’s 6.4 version was leaked in August 2025. With the addition of the HBrowser plugin, the RAT moves beyond harvesting credentials and user data from browsers: it provides the operator with a real-time view of the browser and can relay attacker inputs to the browser. Operator’s interactions are encoded as command-and-control (C&C) commands, transmitted over the standard XWorm AES-encrypted communication channel, and executed on the victim’s system. “The victim machine receives them and executes the corresponding input on the active browser window. The operator receives a continuous stream of screenshots. From the operator’s perspective, it is a full remote browser session. Every authenticated tab is accessible, bypassing the need for logging in and dealing with MFA,” the company explains. The Maps and Microphone plugins allow operators to monitor the victim’s location and to capture audio without privilege escalation and without a user warning. “XWorm continues to evolve and has now added surveillance capabilities. Since its builder and source code were leaked, we expect continued upgrades and use of this toolkit,” Netskope notes. Related: Pre-Baked Firmware Malware Hits Budget Android Devices in 150+ Countries Related: US Disrupts Chinese State-Sponsored Hacking Tools Related: Linux Backdoor Abuses STUN Protocol, Exploits Dozens of Flaws Related: macOS Users Targeted by Fake Zoom Installer Carrying CloudSyncD Backdoor

Some of these have been clearly designed for surveillance: enabling location tracking, live audio streaming, webcam capture, and interactive control over authenticated browser sessions. “The Maps plugin provides victims’ GPS location without a user prompt. The Microphone plugin streams live audio from the victim’s device. HBrowser hijacks authenticated browser sessions without touching credentials, bypassing MFA entirely. Webcam capture is also available on demand,” Netskope says . According to the cybersecurity company, the activity surrounding XWorm has increased since a cracked version of its builder was released publicly in June 2025, and the source code for RAT’s 6.4 version was leaked in August 2025. With the addition of the HBrowser plugin, the RAT moves beyond harvesting credentials and user data from browsers: it provides the operator with a real-time view of the browser and can relay attacker inputs to the browser. Operator’s interactions are encoded as command-and-control (C&C) commands, transmitted over the standard XWorm AES-encrypted communication channel, and executed on the victim’s system. “The victim machine receives them and executes the corresponding input on the active browser window. The operator receives a continuous stream of screenshots. From the operator’s perspective, it is a full remote browser session. Every authenticated tab is accessible, bypassing the need for logging in and dealing with MFA,” the company explains. The Maps and Microphone plugins allow operators to monitor the victim’s location and to capture audio without privilege escalation and without a user warning. “XWorm continues to evolve and has now added surveillance capabilities. Since its builder and source code were leaked, we expect continued upgrades and use of this toolkit,” Netskope notes. Related: Pre-Baked Firmware Malware Hits Budget Android Devices in 150+ Countries Related: US Disrupts Chinese State-Sponsored Hacking Tools Related: Linux Backdoor Abuses STUN Protocol, Exploits Dozens of Flaws Related: macOS Users Targeted by Fake Zoom Installer Carrying CloudSyncD Backdoor

“The Maps plugin provides victims’ GPS location without a user prompt. The Microphone plugin streams live audio from the victim’s device. HBrowser hijacks authenticated browser sessions without touching credentials, bypassing MFA entirely. Webcam capture is also available on demand,” Netskope says . According to the cybersecurity company, the activity surrounding XWorm has increased since a cracked version of its builder was released publicly in June 2025, and the source code for RAT’s 6.4 version was leaked in August 2025. With the addition of the HBrowser plugin, the RAT moves beyond harvesting credentials and user data from browsers: it provides the operator with a real-time view of the browser and can relay attacker inputs to the browser. Operator’s interactions are encoded as command-and-control (C&C) commands, transmitted over the standard XWorm AES-encrypted communication channel, and executed on the victim’s system. “The victim machine receives them and executes the corresponding input on the active browser window. The operator receives a continuous stream of screenshots. From the operator’s perspective, it is a full remote browser session. Every authenticated tab is accessible, bypassing the need for logging in and dealing with MFA,” the company explains. The Maps and Microphone plugins allow operators to monitor the victim’s location and to capture audio without privilege escalation and without a user warning. “XWorm continues to evolve and has now added surveillance capabilities. Since its builder and source code were leaked, we expect continued upgrades and use of this toolkit,” Netskope notes. Related: Pre-Baked Firmware Malware Hits Budget Android Devices in 150+ Countries Related: US Disrupts Chinese State-Sponsored Hacking Tools Related: Linux Backdoor Abuses STUN Protocol, Exploits Dozens of Flaws Related: macOS Users Targeted by Fake Zoom Installer Carrying CloudSyncD Backdoor

According to the cybersecurity company, the activity surrounding XWorm has increased since a cracked version of its builder was released publicly in June 2025, and the source code for RAT’s 6.4 version was leaked in August 2025. With the addition of the HBrowser plugin, the RAT moves beyond harvesting credentials and user data from browsers: it provides the operator with a real-time view of the browser and can relay attacker inputs to the browser. Operator’s interactions are encoded as command-and-control (C&C) commands, transmitted over the standard XWorm AES-encrypted communication channel, and executed on the victim’s system. “The victim machine receives them and executes the corresponding input on the active browser window. The operator receives a continuous stream of screenshots. From the operator’s perspective, it is a full remote browser session. Every authenticated tab is accessible, bypassing the need for logging in and dealing with MFA,” the company explains. The Maps and Microphone plugins allow operators to monitor the victim’s location and to capture audio without privilege escalation and without a user warning. “XWorm continues to evolve and has now added surveillance capabilities. Since its builder and source code were leaked, we expect continued upgrades and use of this toolkit,” Netskope notes. Related: Pre-Baked Firmware Malware Hits Budget Android Devices in 150+ Countries Related: US Disrupts Chinese State-Sponsored Hacking Tools Related: Linux Backdoor Abuses STUN Protocol, Exploits Dozens of Flaws Related: macOS Users Targeted by Fake Zoom Installer Carrying CloudSyncD Backdoor

With the addition of the HBrowser plugin, the RAT moves beyond harvesting credentials and user data from browsers: it provides the operator with a real-time view of the browser and can relay attacker inputs to the browser. Operator’s interactions are encoded as command-and-control (C&C) commands, transmitted over the standard XWorm AES-encrypted communication channel, and executed on the victim’s system. “The victim machine receives them and executes the corresponding input on the active browser window. The operator receives a continuous stream of screenshots. From the operator’s perspective, it is a full remote browser session. Every authenticated tab is accessible, bypassing the need for logging in and dealing with MFA,” the company explains. The Maps and Microphone plugins allow operators to monitor the victim’s location and to capture audio without privilege escalation and without a user warning. “XWorm continues to evolve and has now added surveillance capabilities. Since its builder and source code were leaked, we expect continued upgrades and use of this toolkit,” Netskope notes. Related: Pre-Baked Firmware Malware Hits Budget Android Devices in 150+ Countries Related: US Disrupts Chinese State-Sponsored Hacking Tools Related: Linux Backdoor Abuses STUN Protocol, Exploits Dozens of Flaws Related: macOS Users Targeted by Fake Zoom Installer Carrying CloudSyncD Backdoor

Operator’s interactions are encoded as command-and-control (C&C) commands, transmitted over the standard XWorm AES-encrypted communication channel, and executed on the victim’s system. “The victim machine receives them and executes the corresponding input on the active browser window. The operator receives a continuous stream of screenshots. From the operator’s perspective, it is a full remote browser session. Every authenticated tab is accessible, bypassing the need for logging in and dealing with MFA,” the company explains. The Maps and Microphone plugins allow operators to monitor the victim’s location and to capture audio without privilege escalation and without a user warning. “XWorm continues to evolve and has now added surveillance capabilities. Since its builder and source code were leaked, we expect continued upgrades and use of this toolkit,” Netskope notes. Related: Pre-Baked Firmware Malware Hits Budget Android Devices in 150+ Countries Related: US Disrupts Chinese State-Sponsored Hacking Tools Related: Linux Backdoor Abuses STUN Protocol, Exploits Dozens of Flaws Related: macOS Users Targeted by Fake Zoom Installer Carrying CloudSyncD Backdoor

“The victim machine receives them and executes the corresponding input on the active browser window. The operator receives a continuous stream of screenshots. From the operator’s perspective, it is a full remote browser session. Every authenticated tab is accessible, bypassing the need for logging in and dealing with MFA,” the company explains. The Maps and Microphone plugins allow operators to monitor the victim’s location and to capture audio without privilege escalation and without a user warning. “XWorm continues to evolve and has now added surveillance capabilities. Since its builder and source code were leaked, we expect continued upgrades and use of this toolkit,” Netskope notes. Related: Pre-Baked Firmware Malware Hits Budget Android Devices in 150+ Countries Related: US Disrupts Chinese State-Sponsored Hacking Tools Related: Linux Backdoor Abuses STUN Protocol, Exploits Dozens of Flaws Related: macOS Users Targeted by Fake Zoom Installer Carrying CloudSyncD Backdoor

The Maps and Microphone plugins allow operators to monitor the victim’s location and to capture audio without privilege escalation and without a user warning. “XWorm continues to evolve and has now added surveillance capabilities. Since its builder and source code were leaked, we expect continued upgrades and use of this toolkit,” Netskope notes. Related: Pre-Baked Firmware Malware Hits Budget Android Devices in 150+ Countries Related: US Disrupts Chinese State-Sponsored Hacking Tools Related: Linux Backdoor Abuses STUN Protocol, Exploits Dozens of Flaws Related: macOS Users Targeted by Fake Zoom Installer Carrying CloudSyncD Backdoor

“XWorm continues to evolve and has now added surveillance capabilities. Since its builder and source code were leaked, we expect continued upgrades and use of this toolkit,” Netskope notes. Related: Pre-Baked Firmware Malware Hits Budget Android Devices in 150+ Countries Related: US Disrupts Chinese State-Sponsored Hacking Tools Related: Linux Backdoor Abuses STUN Protocol, Exploits Dozens of Flaws Related: macOS Users Targeted by Fake Zoom Installer Carrying CloudSyncD Backdoor

Ionut Arghire is an international correspondent for SecurityWeek.