XWorm Activity Surges as Four Versions Operate Concurrently
Summary
Netskope reports four XWorm versions operating concurrently and 1,236 detection events across more than 100 customer organizations in Q3 2026, a fourfold increase from Q3 2025.
Key points
- Netskope Threat Labs observed four distinct XWorm versions operating concurrently in the wild.
- It recorded 1,236 detection events across more than 100 customer organizations in Q3 2026, four times the Q3 2025 level.
- The public leak of the V6.4 builder in mid-2025 drove an initial surge; activity has remained above pre-leak levels.
- Financial services represented about 35% of affected customers. Activity was concentrated in India, Brazil, Italy, Panama, and the United States.
Article Details
- Event Type
- XWorm malware activity, with four versions operating concurrently in the wild and elevated detection volume.
- Impact
- Netskope Threat Labs recorded 1,236 events across more than 100 customer organizations in Q3 2026, a fourfold increase over Q3 2025. Financial services accounted for approximately 35% of affected customers.
Malware
Vendors
Countries
BrazilThe financial services sector accounts for approximately 35% of affected customers, with activity concentrated in India, Brazil, Italy, Panama, and the United States.IndiaThe financial services sector accounts for approximately 35% of affected customers, with activity concentrated in India, Brazil, Italy, Panama, and the United States.ItalyThe financial services sector accounts for approximately 35% of affected customers, with activity concentrated in India, Brazil, Italy, Panama, and the United States.PanamaThe financial services sector accounts for approximately 35% of affected customers, with activity concentrated in India, Brazil, Italy, Panama, and the United States.United StatesThe financial services sector accounts for approximately 35% of affected customers, with activity concentrated in India, Brazil, Italy, Panama, and the United States.