XWorm RAT Transforms into Advanced Surveillance Platform

XWorm, a multi-functional Windows-based Remote Access Trojan (RAT), has evolved into an advanced surveillance platform, significantly expanding its capabilities to monitor infected users.

Cybersecurity firm Netskope reports that new plugins allow the malware to track the victim’s location, stream live audio, and interact with authenticated browser sessions without requiring user credentials.

Expanded Surveillance Capabilities

First observed in 2022, XWorm has seen continuous updates to its codebase and functionality. Netskope noted an increase in the number of supported plugins, from 35 in July 2025 to 46 by October 2026. Several of these new plugins are specifically designed for surveillance purposes.

The ‘Maps’ plugin provides victims’ GPS location without any user prompt. The ‘Microphone’ plugin can stream live audio directly from the infected device. Most notably, the ‘HBrowser’ plugin allows operators to hijack authenticated browser sessions, providing a full remote browser view and control while bypassing multi-factor authentication (MFA) entirely.

Netskope explains that operator interactions are encoded as command-and-control (C&C) commands, transmitted over XWorm’s standard AES-encrypted communication channel, and executed on the victim’s system. This grants the attacker access to any authenticated tab within the browser without needing to log in or deal with MFA.

Increased Activity Following Leaks

Netskope observed over 1,200 XWorm incidents across 100 organisations during the third quarter of 2026. This heightened activity follows the public release of a cracked version of the XWorm builder in June 2025 and the subsequent leak of the RAT’s 6.4 version source code in August 2025.

The firm anticipates that the public availability of these tools, combined with the developers’ ongoing efforts to upgrade the malware, will lead to continued upgrades and widespread use of the XWorm toolkit as a versatile cybercrime platform.