How a leaked builder of XWorm turned a remote access trojan into a surveillance kit
October 14, 2026 
Netskope tracks four XWorm versions in the wild, 46 plugins, and new tools for location, audio and live browser control, with detections up fourfold.
Netskope Threat Labs has been following XWorm since September 2024, and its latest report shows the malware has changed a lot. Over the past year the team identified four distinct versions running at the same time in the wild. Detection volume is still high, with 1,236 events across more than 100 customer organizations in the third quarter of 2026, four times the number from the same quarter in 2025.
The leak fueled the surge. In June 2025, a cracked version of the XWorm builder was released publicly. In August, the source code for a modified version, 6.4, also leaked. These leaks gave XWorm more exposure and helped drive its growth.
Netskope’s data shows how long the impact lasted. Detections more than quadrupled between the third and fourth quarters of 2025. In the first quarter of 2026, they reached seven times the original level and stayed there through the second quarter. Detections fell to 1,236 in the third quarter of 2026, but September alone accounted for 601, matching the monthly average during the peak in the first half of the year.
The victims skew toward money. Financial services make up about 35% of affected customers, and activity is concentrated in India, Brazil, Italy, Panama and the United States.
“The public leak of the V6.4 builder in mid-2025 drove this initial surge, keeping activity consistently above pre-leak baselines ever since.” reads Netskope’s analysis. “The financial services sector accounts for approximately 35% of affected customers, with activity concentrated in India, Brazil, Italy, Panama, and the United States.”
Since Netskope published its report on version 6.0 in July 2025, four new versions of the malware have been discovered: V6.4, V6.5 (“XWorm Reborn”), V7.2, and V7.4. Three of these versions were released after the malware generator tool became publicly available. The number of known plugin features has also increased from 35 to 46. This includes new modules, such as SteamTokenRecovery, Rootkit, ResetSurvival, and Cmstp-Bypass, as well as several plugins that were previously removed in V6.0 but have now been brought back.
Each new version includes small but significant updates:
- V6.4 includes file details that link it to celestialproject.org.
- V6.5 updates its branding link to c3lestial.fun, adds five new plugins, and introduces a built-in license check for the tool itself.
- V7.2 adds stronger code protection to hide its activity, uses six different tricks to avoid running in virtual analysis environments, and disguises its file details as the software Voicemod.
- V7.4 introduces a new file delivery system (dropper), uses a technique to bypass Windows security monitoring, switches to a new communication channel for commands, and reinstates license checks.
The surveillance side is where it gets uncomfortable. Netskope says XWorm has moved from an infostealer to a full surveillance platform. Three plugins matter most: Maps, Microphone and HBrowser, and webcam capture is also available on demand.
HBrowser changes how account theft works. Starting with version 6, it gives the operator a live view of the victim’s running browser, relays the operator’s mouse, keyboard and paste actions into it, and streams the screen back. The commands travel over XWorm’s usual encrypted channel and run on the victim’s machine.
This creates a full remote browser session for the attacker. Because every logged-in tab remains open, the attacker can access accounts directly without needing to steal passwords or bypass multi-factor authentication (MFA). Netskope notes that this plugin grants full account access without ever extracting login credentials.
The location-tracking feature bypasses the standard Windows permission prompt. It first modifies a Windows system setting to suppress consent requests, then attempts to fetch precise GPS coordinates within 15 seconds to send to the attacker. If GPS is unavailable, it falls back to IP-based location tracking. Because the modified setting remains in place, future location requests continue to bypass user permission.
“XWorm continues to evolve and has now added surveillance capabilities. It can track geolocation and record the victim’s audio without requesting the victim’s permission.” continues the report. “The HBrowser plugin gives operators direct control of the victim’s live browser session, granting access to accounts without needing to exfiltrate credentials and making MFA irrelevant.”
Microphone does what the name says. It captures audio from any device on the machine, with the operator choosing which one, and streams it back in half-second chunks that are compressed, encoded and encrypted, so audio reaches the operator with about half a second of delay. The microphone stays active for as long as the operator keeps the session open, and both Maps and Microphone run without privilege escalation or a visible prompt.
Netskope expects more of the same. Since the builder and source code were leaked, it expects continued upgrades and use of the toolkit. Its indicators of compromise are on the team’s GitHub, and its protection flags the samples as Gen:Variant.Application.Lazy and Trojan.Generic.
The key lesson for security teams is that multi-factor authentication (MFA) cannot protect accounts once an attacker has already gained access to an active browser session. This vulnerability applies to any account currently logged in on an infected computer.
The HBrowser plugin clearly demonstrates this risk: from the attacker’s perspective, it provides a complete, live remote browser session with full access to open accounts.
“Since its builder and source code were leaked, we expect continued upgrades and use of this toolkit. Netskope Threat Labs will continue to monitor XWorm.” NetSkope concludes.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
Pierluigi Paganini
(SecurityAffairs – hacking, CISA)
