XWorm Adds Silent Location and Audio Surveillance, Live Browser Control
Summary
Netskope reports four XWorm versions active in 2026 and a fourfold year-over-year rise in detections. Its analysis details plugins for browser-session control, silent GPS access, live microphone streaming and on-demand webcam capture.
Key points
- Netskope recorded 1,236 XWorm detection events across more than 100 customer organizations in Q3 2026, four times the Q3 2025 volume.
- The report identifies four versions operating in the wild: V6.4, V6.5, V7.2 and V7.4; it attributes increased activity partly to public releases of the builder and modified source code.
- The HBrowser plugin relays operator input to a victim’s active browser and streams screenshots over XWorm’s AES-encrypted C2 channel, enabling interaction with authenticated sessions without handling credentials.
- The Maps plugin changes a Windows location-consent registry setting before requesting location data, which the report says allows it to operate without a visible user prompt; it can fall back to IP geolocation.
- The Microphone plugin captures audio in 500-millisecond buffers, compresses and encodes them, then streams them to the operator over C2.
- Netskope says the confirmed plugin count rose from 35 to 46, adding surveillance capabilities that include on-demand webcam capture.
Article Details
- Attack Vectors
- XWorm's HBrowser plugin gives operators interactive control of a victim's active browser session and access to authenticated tabs, relaying keyboard and mouse inputs and returning screenshots over the C2 channel.
- The Maps plugin changes the Windows location-consent registry value to Allow before requesting location data, bypassing the user prompt; it uses GPS when available and otherwise falls back to IP geolocation.
- The Microphone plugin captures audio from a selected device and streams compressed audio buffers to the operator over the C2 channel.
- XWorm supports on-demand webcam capture. Version 7.2 also uses native-code obfuscation and an anti-VM battery.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationVersion 7.2 is reported to use native-code obfuscation.T1036 · MasqueradingVersion 7.2 reportedly uses a Voicemod PE spoof.T1041 · Exfiltration Over C2 ChannelThe Maps and Microphone plugins transmit collected location coordinates and audio over XWorm's C2 channel.T1112 · Modify RegistryThe Maps plugin writes Allow to the Windows location-consent registry value before requesting location data.T1113 · Screen CaptureHBrowser continuously streams screenshots of the victim's browser session to the operator.T1123 · Audio CaptureThe Microphone plugin records audio from a selected device and sends captured audio to the operator.T1125 · Video CaptureThe article reports on-demand webcam capture as an XWorm capability.T1497.001 · System ChecksVersion 7.2 is reported to use a six-technique anti-VM battery.T1573 · Encrypted ChannelXWorm uses an AES-encrypted C2 channel; the article also specifies AES-128-ECB encryption for microphone-stream transmission.T1614.001 · System Language DiscoveryThe Maps plugin obtains victim location through GPS or, if GPS is unavailable, IP geolocation.
Malware
Vendors
Products
Countries
BrazilThe financial services sector accounts for approximately 35% of affected customers, with activity concentrated in India, Brazil, Italy, Panama, and the United States.IndiaThe financial services sector accounts for approximately 35% of affected customers, with activity concentrated in India, Brazil, Italy, Panama, and the United States.ItalyThe financial services sector accounts for approximately 35% of affected customers, with activity concentrated in India, Brazil, Italy, Panama, and the United States.PanamaThe financial services sector accounts for approximately 35% of affected customers, with activity concentrated in India, Brazil, Italy, Panama, and the United States.United StatesThe financial services sector accounts for approximately 35% of affected customers, with activity concentrated in India, Brazil, Italy, Panama, and the United States.