XWorm Reborn: From infostealer to surveillance platform

Summary

In September 2024, Netskope Threat Labs first reported on XWorm and its infection chain. The following year, in July 2025, we reported version 6.0 and its more advanced features. As we continued tracking the malware over the past year, we identified four distinct XWorm versions operating concurrently in the wild. Detection volume remains elevated, with Netskope Threat Labs recording 1,236 events across more than 100 customer organizations in Q3 2026, marking a 4x increase over Q3 2025. The public leak of the V6.4 builder in mid-2025 drove this initial surge, keeping activity consistently above pre-leak baselines ever since. The financial services sector accounts for approximately 35% of affected customers, with activity concentrated in India, Brazil, Italy, Panama, and the United States.

In addition to the new variants, the confirmed plugin count has expanded from 35 to 46 since our July 2025 report, bringing surveillance capabilities to XWorm and marking its evolution from an infostealer into a full surveillance platform. The Maps plugin provides victims’ GPS location without triggering a user prompt. The Microphone plugin streams live audio from the victim’s device. HBrowser gives operators interactive control of authenticated browser sessions without touching credentials, bypassing MFA entirely. Webcam capture is also available on demand.

Key findings

• XWorm detections surged fourfold year-over-year 
  Netskope Threat Labs recorded a 4x increase in XWorm detection activity from Q3 2025 to Q3 2026, logging 1,236 events across more than 100 customer organizations
• Four new versions, 11 more plugins since our last report. 
  V6.4, V6.5 “XWorm Reborn”, V7.2, and V7.4 were all identified since our July 2025 report, three of which emerged following the public release of the XWorm builder in mid-2025. New modules include SteamTokenRecovery, Rootkit, ResetSurvival, and Cmstp-Bypass, alongside re-enabled plugins removed in V6.0.
• XWorm now ships a physical surveillance stack 
  The Maps plugin provides victims’ GPS location without a user prompt. The Microphone plugin streams live audio from the victim’s device. HBrowser hijacks authenticated browser sessions without touching credentials, bypassing MFA entirely. Webcam capture is also available on demand.

XWorm Activity surge following the builder leak

In June 2025, a cracked version of the XWorm builder was released to the public, followed by a release of the modified version 6.4 source code leak in August. After these releases, Netskope telemetry shows XWorm detection activity increasing more than 4x between Q3 and Q4 2025, then surging in Q1 2026 to 7x the original baseline and holding there throughout Q2 2026.

While Q3 2026 volume dipped to 1,236 detections, September accounted for 601 of those events. Reaching the monthly average seen during the Q1 and Q2 peak, this surge demonstrates that XWorm activity remains well above pre-leak baselines entering Q4 2026.

Since our July 2025 V6.0 report, we have identified four XWorm versions in the wild:

HBrowser: Session hijacking without credentials

Aside from static credential and browser data harvesting, XWorm now includes interactive browser control. Starting in version 6, XWorm now has an HBrowser plugin that gives the operator a live view of the victim’s running browser and relays operator inputs to the victim’s browser while streaming the screen back.

The operator selects a target browser from the panel. The C2 panel binary has a dedicated menu item click handler for each supported browser, each sending an OpenBrowser command over the C2 channel:

private void ChromeToolStripMenuItem_Click(object sender, EventArgs e) {
    byte[] state = Helper.SB("OpenBrowser" + SettingsHelper.SPL + "chrome" + SettingsHelper.SPL
        + SettingsHelper.SPL + this.PictureBox1.Width + SettingsHelper.SPL + this.PictureBox1.Height);
    this.C.BeginSend(state);
}

Once connected, every interaction the operator performs in the HBrowser panel is encoded as a C2 command and executed on the victim machine. All commands travel over the standard XWorm AES-encrypted C2 channel.

OpenBrowser<SPL>chrome<SPL><width><SPL><height>
keyboardClick<SPL><base64(char)>
LeftDown<SPL><x><SPL><y>
LeftUp<SPL><x><SPL><y>
MoveCursor<SPL><x><SPL><y>
ScrollDown / ScrollUp
paste<SPL><base64(clipboard_text)>
CloseHBrowser<SPL><width><SPL><height>

The victim machine receives them and executes the corresponding input on the active browser window. The operator receives a continuous stream of screenshots. From the operator’s perspective, it is a full remote browser session. Every authenticated tab is accessible, bypassing the need for logging in and dealing with MFA.

Location and audio surveillance

Two other noteworthy plugins analyzed from new version samples are Maps and Microphone. The Maps plugin locates the victim, while the Microphone plugin records audio near the victim’s device. Both run without privilege escalation or a visible prompt to the user.

Maps: Silent GPS. Whenever an application needs to know the location of a user, Windows requests consent and requires approval. The Maps plugin skips it by writing Allow to the CapabilityAccessManager registry key.

shell.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\location\Value", "Allow", "REG_SZ"

Because the plugin modifies the registry before making the API call, Windows grants the victim location request without showing a user prompt. The Maps plugin calls GeoCoordinateWatcher.TryStart with a 15-second timeout, waits for a GPS fix, and transmits the coordinates to the operator in the following format:

GMapsapi<SPL><IDD><SPL><lat>,<lon>

If the victim machine does not have GPS available, the Maps plugin falls back to IP geolocation via http://ip-api.com/csv/?fields=lat,lon. The consent registry key persists after the first write. Every request after that skips the check.

Microphone: Live Audio Streaming. Microphone uses NAudio’s WaveInEvent to capture audio from any device on the victim machine. The operator selects the recording device by index. The plugin enumerates available devices over the C2 channel (MICCM) before capture begins. The audio capture routine samples input at 8 kHz/16-bit mono across 500-millisecond buffers, and each buffer is gzip-compressed, base64-encoded, and streamed back over the C2 channel as:

MICGET<SPL><base64(gzip(PCM))><SPL><bytesRecorded><SPL><hwid>

The stream is AES-128-ECB encrypted before transmission. The operator can stop capture (CLOSEMIC) or terminate the session (ENDMIC) at any time. The 500-millisecond buffer means audio reaches the operator panel with roughly half a second of latency. The microphone is active for as long as the operator keeps the session open.

Conclusions

XWorm continues to evolve and has now added surveillance capabilities. It can track geolocation and record the victim’s audio without requesting the victim’s permission. The HBrowser plugin gives operators direct control of the victim’s live browser session, granting access to accounts without needing to exfiltrate credentials and making MFA irrelevant. Since its builder and source code were leaked, we expect continued upgrades and use of this toolkit. Netskope Threat Labs will continue to monitor XWorm.

IOCs

All the IOCs related to this malware are found in our GitHub repository.

Netskope detection

• Netskope Threat Protection
  • Gen:Variant.Application.Lazy
  • Trojan.Generic