XWorm Malware Turns Into Surveillance Platform Following Code Leaks

Netskope Threat Labs has identified four versions of the XWorm remote access trojan running at the same time in the wild. The malware was first observed in 2022 but has evolved significantly since then. In the third quarter of 2026, detections reached more than 1,200 incidents across over 100 organizations. This activity marks a major increase from the previous year.

Security researchers say public leaks drove this surge in activity. A cracked version of the XWorm builder was released in June 2025, followed by source code for version 6.4 in August. These releases gave the malware more exposure and helped drive its growth. Detections quadrupled between late 2025 and early 2026.

The number of known plugin features has also grown from 35 to 46 since July 2025. New modules include tools for location tracking, audio recording, and live browser control. Each new version includes small updates that hide activity or bypass security monitoring features on Windows systems.

Surveillance capabilities are a key change in the malware's function. The Maps plugin provides GPS location without requiring a user permission prompt. The Microphone plugin streams audio from the victim's device with very little delay. Both tools run without needing higher system privileges or visible warnings to the user.

A new browser control plugin changes how attackers steal account access. HBrowser gives operators a live view of the victim's running browser and allows them to input mouse and keyboard actions. This method makes multi-factor authentication irrelevant because the accounts are already logged in and active during the session.

Victims are often connected to financial services which make up about 35% of affected customers. Activity is concentrated in India, Brazil, Italy, Panama and the United States. The public leak of the builder tool kept activity consistently above pre-leak baselines for an extended period.

Netskope expects continued upgrades and use of this toolkit since the source code is now public. Security teams must recognize that multi-factor authentication cannot protect accounts once an active browser session is controlled by an attacker. Netskope will continue to monitor XWorm as indicators of compromise are updated on GitHub.