XWorm is a cheap remote access trojan whose builder leaked last year, and it can now drive a victim’s logged-in browser, so the attacker never has to steal a password or answer an MFA prompt. Netskope’s latest analysis finds 46 plugins, including silent location tracking and live microphone streaming, and detections up fourfold year on year.
What happened
On 12 October 2026 Netskope Threat Labs published fresh research on XWorm, a Windows remote access trojan (RAT) first seen in 2022. Its earlier reports covered the infection chain in September 2024 and version 6.0 in July 2025. Since then the team has found four versions running in parallel: V6.4, V6.5 (branded “XWorm Reborn”), V7.2 and V7.4. The number of confirmed plugins has risen from 35 to 46.
In the third quarter of 2026 Netskope logged 1,236 XWorm detections spread over more than 100 of its customers, four times the figure for the same quarter of 2025. September alone produced 601, in line with the monthly average during the peak of the first half of 2026. About 35% of affected customers are financial services firms, and activity was concentrated in India, Brazil, Italy, Panama and the United States.
Netskope blames the growth on leaks. A cracked copy of the XWorm builder became public in June 2025, and modified V6.4 source code followed in August. Detections then climbed to roughly seven times the original baseline in early 2026 and held there through the second quarter. SecurityWeek, GBHackers and Cyber Security News all reported the findings on 13 October. GBHackers pointed out that these are one vendor’s figures, not a global infection count.
The technical picture
The plugin that matters most to defenders is HBrowser, which arrived in version 6. It does not scrape saved passwords or copy cookie files. Instead, it opens the victim’s own browser under the operator’s control. The operator chooses Chrome or another supported browser from the control panel, gets a continuous stream of screenshots, and sends mouse, keyboard, scroll and clipboard actions back through XWorm’s encrypted command channel. In practice the attacker is sitting at the victim’s browser. Every tab that is already signed in can be used without a password, and MFA never comes into play because the session is already authenticated.
Netskope calls this a move from infostealer to surveillance platform, and the rest of the new modules support that label:
- Maps changes Windows’ per-user location consent setting so that location requests are approved without the user seeing a prompt. It then reports GPS coordinates, or falls back to IP geolocation if the machine has no GPS.
- Microphone picks a recording device on the host and streams compressed audio in half-second chunks, so the operator hears the room with roughly 500 milliseconds of delay for as long as the session stays open.
- Webcam capture is available on request.
The version history shows the malware is still being actively developed. V6.5 added Rootkit, SteamTokenRecovery, HRDP, Cmstp-Bypass and ResetSurvival modules, plus licence enforcement through the KeyAuth service. V7.2 added native-code obfuscation and six separate anti-virtual-machine checks. V7.4 introduces an XBinder dropper, unhooks NTdll.dll to blind user-mode monitoring, and uses the LocaltoNet tunnelling service for command and control. Indicators of compromise are on Netskope’s GitHub.
Why it matters for UK organisations
Netskope’s research does not name the UK among the most affected countries. Everything in this section is our own professional reading of what the findings mean for UK organisations, not a claim from the researchers.
MFA has become the headline control in UK guidance: the NCSC recommends it, insurers ask about it, and Cyber Essentials requires it for cloud services. That was right, and MFA still stops a great deal of credential phishing. But HBrowser shows how quickly commodity criminals adapt when a defence becomes widespread. If the attacker is operating inside a live session on a compromised laptop, it does not matter how strong the sign-in was. A leaked builder puts this kind of session hijacking within reach of anyone.
The 35% financial services share should get attention in the City and among the many UK payment, lending and wealth firms whose staff work in browser-based platforms all day. Payment approvals, HR systems and cloud consoles behind single sign-on are exactly what a hijacked browser serves best. The silent microphone and location modules also raise questions under UK GDPR and for executive protection.
Expert view
In my experience, red teams have long worked on the principle that you rarely need the password if you can borrow the session. What has changed is who can do it. When we test, interactive browser control on a compromised endpoint usually takes custom tooling and an experienced operator. XWorm turns it into a menu option in a panel that leaked for free. Netskope describes HBrowser as bypassing MFA entirely, but it does not break MFA. It sidesteps it after an earlier failure, which is the endpoint being compromised in the first place. That tells you where to put your effort.
The telemetry needs some caution. One vendor’s detection events are not infections, and a fourfold rise from a modest base is still modest across the economy as a whole. But the direction is clear, and the surveillance features put XWorm closer to stalkerware than to a password stealer. The anti-analysis work in V7.2 and V7.4 also shows the maintainers are investing in evading endpoint tools.
As a commodity RAT, XWorm is usually delivered through phishing attachments, loaders and fake installers rather than targeted exploits. That means the basics still work against it, if they are actually enforced.
What to do now
- Treat endpoint compromise as an identity event. When EDR flags a RAT on a device, revoke that user’s active sessions and refresh tokens across your identity provider and SaaS estate, not just the local machine.
- Bind sessions to devices. Where your platform supports it, use token protection, compliant-device conditional access and short session lifetimes for high-value applications such as payments, finance and admin consoles.
- Require step-up approval for sensitive actions. Ask for phishing-resistant re-authentication, ideally FIDO2 or passkeys, before payments, mailbox rule changes or privilege grants, so that a hijacked session alone is not enough.
- Harden the entry points. Cyber Essentials malware protection and secure configuration controls apply directly here. Block executables and script files from email and downloads, restrict who can install software, and use application allow-listing on finance and executive endpoints.
- Hunt for the surveillance modules. Watch for unexpected changes to Windows location consent settings, unknown processes opening the microphone or webcam, and outbound connections to tunnelling services such as LocaltoNet. Load Netskope’s published indicators into your detection stack.
- Check the user-mode blind spot. Make sure your EDR does not rely only on user-mode hooks, and test how it behaves when NTdll is unhooked.
Bottom line
XWorm has gone from an off-the-shelf password stealer to a leaked surveillance toolkit that can take over a signed-in browser and listen to the room. MFA remains essential, but it protects the login, not the session that follows. UK organisations, financial firms in particular, should make sure their response playbooks revoke sessions as soon as a device is compromised, and should require strong re-authentication before anything that moves money or grants access.
Sources
- Netskope Threat Labs: XWorm Reborn: From infostealer to surveillance platform
- SecurityWeek: XWorm RAT Evolves Into Surveillance Platform
- GBHackers: XWorm HBrowser Plugin Lets Attackers Control Authenticated Browser Sessions Without Credentials
- Cyber Security News: XWorm Malware Can Spy Through Your Microphone and Hijack Logged-In Browser Sessions
