XWorm RAT Adds Plugins for Location, Audio and Browser Surveillance
Summary
Netskope reports that XWorm RAT has expanded its plugins to enable location tracking, live audio, webcam capture and interactive control of authenticated browser sessions, while activity has increased following leaks of its builder and source code.
Key points
- XWorm is a Windows RAT that can provide attackers control of infected systems, including keylogging, screenshots, webcam access and payload execution.
- Netskope observed over 1,200 incidents across 100 organizations in the third quarter.
- Supported plugins increased from 35 in July 2025 to 46 in October 2026.
- New surveillance plugins can track location, stream microphone audio, capture webcam footage and control authenticated browser sessions.
- The HBrowser plugin relays operator inputs to the active browser and returns screenshots, enabling access to authenticated tabs without handling credentials or MFA.
- Netskope says XWorm activity increased after a cracked builder was released in June 2025 and version 6.4 source code leaked in August 2025.
Article Details
- Attack Vectors
- XWorm operators use the HBrowser plugin to interact with authenticated browser sessions remotely, relay inputs to the active browser window, and receive screenshots.
- XWorm plugins can obtain GPS location, stream live audio, and capture webcam footage without a user prompt or warning, according to Netskope.
- XWorm operator interactions are transmitted as commands over the malware's AES-encrypted command-and-control channel.
MITRE ATT&CK
T1056.001 · KeyloggingXWorm provides keylogging capabilities.T1113 · Screen CaptureXWorm can capture screenshots, including a continuous stream from the active browser session.T1123 · Audio CaptureThe Microphone plugin streams live audio from the victim's device.T1125 · Video CaptureXWorm supports on-demand webcam capture.T1614.001 · System Language DiscoveryThe Maps plugin obtains the victim's GPS location without a user prompt.