Malware & Threats
XWorm RAT Evolves Into Surveillance Platform
Expanded plugin count allows the malware to monitor users’ location, stream live audio, and interact with authenticated browser sessions.
By
|
October 13, 2026 (7:13 AM ET)
- + Flipboard + Reddit [+ Whatsapp](https://web.whatsapp.com/send?text=XWorm RAT Evolves Into Surveillance Platform https://www.securityweek.com/xworm-rat-evolves-into-surveillance-platform/) [+ Whatsapp](whatsapp://send?text=XWorm RAT Evolves Into Surveillance Platform https://www.securityweek.com/xworm-rat-evolves-into-surveillance-platform/) + Email
The XWorm RAT developers have expanded the malware’s capabilities with fresh plugins that turn it into a surveillance platform, cybersecurity firm Netskope reports.
A sophisticated, multi-functional Windows RAT first observed in 2022, XWorm provides attackers with full control over the infected systems, offering keylogging, screenshot capture, webcam access, and payload execution capabilities.
The malware’s developers have been constantly updating its codebase and adding new functionality, and the threat has remained highly active, with Netskope observing over 1,200 incidents across 100 organizations during the third quarter of the year.
Alongside new variants, the developers have also increased the number of plugins XWorm supports, from 35 in July 2025 to 46 in October 2026.
Some of these have been clearly designed for surveillance: enabling location tracking, live audio streaming, webcam capture, and interactive control over authenticated browser sessions.
“The Maps plugin provides victims’ GPS location without a user prompt. The Microphone plugin streams live audio from the victim’s device. HBrowser hijacks authenticated browser sessions without touching credentials, bypassing MFA entirely. Webcam capture is also available on demand,” Netskope says .
Advertisement. Scroll to continue reading.
According to the cybersecurity company, the activity surrounding XWorm has increased since a cracked version of its builder was released publicly in June 2025, and the source code for RAT’s 6.4 version was leaked in August 2025.
With the addition of the HBrowser plugin, the RAT moves beyond harvesting credentials and user data from browsers: it provides the operator with a real-time view of the browser and can relay attacker inputs to the browser.
Operator’s interactions are encoded as command-and-control (C&C) commands, transmitted over the standard XWorm AES-encrypted communication channel, and executed on the victim’s system.
“The victim machine receives them and executes the corresponding input on the active browser window. The operator receives a continuous stream of screenshots. From the operator’s perspective, it is a full remote browser session. Every authenticated tab is accessible, bypassing the need for logging in and dealing with MFA,” the company explains.
The Maps and Microphone plugins allow operators to monitor the victim’s location and to capture audio without privilege escalation and without a user warning.
“XWorm continues to evolve and has now added surveillance capabilities. Since its builder and source code were leaked, we expect continued upgrades and use of this toolkit,” Netskope notes.
Related: Pre-Baked Firmware Malware Hits Budget Android Devices in 150+ Countries
Related: US Disrupts Chinese State-Sponsored Hacking Tools
Related: Linux Backdoor Abuses STUN Protocol, Exploits Dozens of Flaws
Related: macOS Users Targeted by Fake Zoom Installer Carrying CloudSyncD Backdoor
Written By
Ionut Arghire is an international correspondent for SecurityWeek.
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.
More from Ionut Arghire
- SAP Patches Critical NetWeaver, S/4HANA Vulnerabilities
- $86 Million Crypto Heist Linked to Ledger Signer Hardware Implant
- Cyberattack Prompts Grocery Giant Ahold Delhaize to Disconnect Systems
- Refrigeration Controller Hack Spoils Food Across European Supermarkets
- Mastermind of 15,000-Mule Cybercrime Laundering Network Pleads Guilty in US
- iRhythm Data Breach Impacts at Least 360,000 People
- Critical SonicWall Vulnerability Exploited Days After Disclosure
- Let’s Encrypt Cuts Default Certificate Validity to 64 Days Ahead of 45-Day Switch
Latest News
- AI Agents Navigate Unfamiliar OT Systems and Move Equipment in Minutes, Booz Allen Finds
- ICS Patch Tuesday: Siemens Issues 17 Advisories, Rockwell Fixes ArmorBlock Takeover Flaw
- Harmonic Security Raises $50 Million for Workforce AI Protection
- Virtual Event Today: Zero Trust Strategies Summit
- Microsoft Disrupts Chinese-Language Phishing Market Behind 1B+ Messages
- US Arrests Two in Crackdown on North Korean IT Worker Laptop Farms
- Chrome, Firefox Updates Patch 114 Flaws as Mozilla Unveils Firefox Enterprise
- Citrix, Fortinet, Ivanti Patch 29 Vulnerabilities Across Their Products
Trending
iRhythm Data Breach Impacts at Least 360,000 People
Meta Says Hackers Took Code, Personal Data of 1,500 in GitHub Breach
Cyberattack Prompts Grocery Giant Ahold Delhaize to Disconnect Systems
Small AI Models Could Soon Self-Replicate on IoT Devices, Anthropic Warns
US Seeks Alleged Chinese Hafnium Hacker With $10 Million Reward
Microsoft Patches Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Day
Adobe Patches 176 Vulnerabilities Across 11 Products
Ransomware Response Expert Arrested in ShinyHunters FBI Hack Probe
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
## Webinar: The AI Access Risk Already in Your Google Workspace
October 19, 2026
AI tools connected to Google Workspace can access millions of sensitive emails and files. Join this session to uncover your organization’s risk and learn a framework to manage AI access.
## Virtual Event: Zero Trust & Identity Strategies Summit 2026
October 14, 2026
Join as we decipher the world of zero trust and share war stories on securing an organization by eliminating implicit trust and continuously validating every stage of a digital interaction.
People on the Move
Adam Zolle has joined Nike as CISO.
Jeff Hackett has been appointed CFO at internet intelligence provider Censys.
Accenture Federal Services has named Nathaniel Parker as CISO.
Expert Insights
## AI Has Changed Attack Speed, Not Security Fundamentals
As AI accelerates vulnerability discovery and exploitation, so-called virtual patching still comes down to defense-in-depth and strong application security fundamentals. (Joshua Goldfarb)
## Four Cyber Threats Harboring Big Plans for the Future
- AI, supply-chain exposure, quantum computing and geopolitical conflict are testing security programs. Preparing for disruption must become part of day-to-day operations. (Steve Durbin)
## Begin at the End: How to Enable Agentic Remediation
Agentic remediation is not an act of faith. We are talking about fixing known problems, not judgment calls about unfamiliar risk. (Nadir Izrael)
## “We Think the Security Control Is Working” Is No Longer Good Enough
Point-in-time audits and sampled assessments offer only snapshots; continuous control monitoring provides evidence that security controls are working today. (Sravish Sridhar)
## This Key Will Self-Destruct: An Open Standard for Revocable API Keys
Every leaked credential should be dead, or dying, within sixty seconds of being found. Here’s a proposal to make that the default. (Matt Honea)
- + Flipboard + Reddit [+ Whatsapp](https://web.whatsapp.com/send?text=XWorm RAT Evolves Into Surveillance Platform https://www.securityweek.com/xworm-rat-evolves-into-surveillance-platform/) [+ Whatsapp](whatsapp://send?text=XWorm RAT Evolves Into Surveillance Platform https://www.securityweek.com/xworm-rat-evolves-into-surveillance-platform/) + Email
Popular Topics
Security Community
- Virtual Cybersecurity Events
- Webcast Library
- CISO Forum
- AI Risk Summit
- ICS Cybersecurity Conference
- Cybersecurity Newsletters
Stay Intouch
About SecurityWeek
News Tips
Got a confidential news tip? We want to hear from you.
Advertising
Reach a large audience of enterprise cybersecurity professionals
Daily Briefing Newsletter
Subscribe to the SecurityWeek Daily Briefing and get the latest content delivered to your inbox.
Copyright © 2026 SecurityWeek ®, a Wired Business Media Publication. All Rights Reserved.