Skip to content

Back to the catalog

XWorm RAT Evolves Into Surveillance Platform
securityweek.comarticle

XWorm RAT Evolves Into Surveillance Platform

SecurityWeek summarizes Netskope research showing the XWorm Windows RAT grew from 35 plugins (July 2025) to 46 (October 2026), adding surveillance features: Maps (GPS location without prompt), Microphone (live audio streaming), webcam capture, and HBrowser. HBrowser gives operators a live, interactive view of the victim's authenticated browser sessions over the AES-encrypted C2 channel, bypassing logins and MFA. Activity rose after the builder was cracked in June 2025 and the 6.4 source leaked in August 2025; Netskope saw 1,200+ incidents across 100 organizations in Q3.

TL;DR Netskope: XWorm RAT now has 46 plugins, including HBrowser session hijacking that bypasses MFA, plus GPS, microphone and webcam surveillance.
Open original ↗

Organisations named here

  • HBrowser
  • Maps plugin
  • Microphone plugin
  • Netskope

Technologies named here

  • Windows
  • XWorm RAT
  • XWorm Maps plugin
  • Authenticated browser sessions on infected machines
  • XWorm Microphone plugin
  • XWorm HBrowser plugin
  • XWorm Webcam capture plugin
  • Netskope

Techniques named here

  • Keylogging
  • Screenshot capture
  • Webcam access and capture
  • Payload execution
  • Location tracking via GPS without user prompt
  • Live audio streaming
  • Remote browser control
  • Capturing audio and location without privilege escalation

Threat actors named here

  • XWorm

Related in Threat Intel