● Covered by 1 source · 1 reportMedium impact1 negative
XWorm RAT Evolves into Surveillance Platform with New Plugins
Key points
- XWorm RAT now includes surveillance plugins.
- New plugins enable GPS tracking, live audio, and webcam access.
- HBrowser plugin allows interactive control of authenticated browser sessions.
- XWorm activity increased after builder and source code leaks.
XWorm Adds Surveillance Capabilities
The XWorm Remote Access Trojan (RAT), first observed in 2022, has evolved to include advanced surveillance capabilities through new plugins, according to cybersecurity firm Netskope. These additions transform the malware into a surveillance platform, providing attackers with more extensive control over infected systems.
New Plugins and Increased Activity
XWorm's developers have consistently updated its codebase, increasing the number of supported plugins from 35 in July 2025 to 46 in October 2026. Netskope reported over 1,200 XWorm incidents across 100 organizations during the third quarter of the year. This increased activity follows the public release of a cracked builder version in June 2025 and the leak of its 6.4 version source code in August 2025.
Interactive Browser Control
A significant new plugin, HBrowser, allows operators to hijack authenticated browser sessions without requiring credentials or bypassing multi-factor authentication. This plugin provides a real-time view of the victim's browser and relays attacker inputs, effectively creating a full remote browser session where every authenticated tab is accessible. Other surveillance plugins include Maps for GPS location tracking, Microphone for live audio streaming, and Webcam for on-demand video capture.
Impact on Victims
The new capabilities move XWorm beyond simple data harvesting, enabling comprehensive remote control and monitoring. The operator's interactions are transmitted as AES-encrypted command-and-control commands, executed on the victim's system, while a continuous stream of screenshots provides visual feedback to the attacker. This allows for deep intrusion and control over a victim's online activities.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Reporting from
The XWorm Remote Access Trojan (RAT) has expanded its capabilities with new plugins that enable surveillance features like location tracking, live audio streaming, and interactive browser session control. This evolution allows attackers to bypass multi-factor authentication and gain full remote control over browser sessions, increasing the malware's threat level.