XWorm operators can now draw on 46 plugins capable of turning infected Windows systems into live surveillance devices, according to Netskope findings reported by SecurityWeek. The plugin count increased from 35 in July 2025 to 46 in October 2026.
The additions extend an already capable remote access trojan. XWorm’s baseline functions include recording keystrokes, taking screenshots, accessing webcams and executing additional payloads. Together, these features can give an operator extensive control over a compromised computer.
Netskope also reported more than 1,200 XWorm-related incidents across 100 organizations during the third quarter. Those figures describe security incidents and affected organizations, not a count of unique people or confirmed individual victims.
Plugins expose location, audio and authenticated browser sessions
The surveillance functions described by Netskope target several sources of sensitive information:
- Maps plugin: obtains the device’s GPS location without displaying a prompt to the user.
- Microphone plugin: streams live audio from the compromised device. Netskope says this does not require privilege escalation and produces no warning for the user.
- HBrowser plugin: provides a real-time view of the browser and forwards the operator’s input to it.
- Webcam capture: allows the operator to request images from the camera.
HBrowser presents a particular risk to accounts protected by multi-factor authentication. Netskope says the plugin takes control of an already authenticated browser session rather than stealing and replaying the user’s credentials. The operator receives a continuous sequence of screenshots, can interact with the browser and can reach authenticated tabs.
In that scenario, MFA may have worked correctly during login but cannot by itself stop an attacker who is remotely controlling the trusted, already signed-in endpoint. The reported capability is therefore a session-hijacking technique rather than a direct compromise of the authentication factor.
Operator instructions are delivered as command-and-control messages through XWorm’s standard channel, which Netskope describes as AES-encrypted. The infected system then performs the requested actions locally.
Leaked development resources lowered barriers around XWorm
Netskope says XWorm was first observed in 2022. Access to its development resources later widened: a cracked copy of the malware builder appeared publicly in June 2025, followed by a leak of the source code for version 6.4 in August 2025.
The researchers associate increased XWorm activity with those releases. Public access to a builder and source code can enable more operators to create variants or modify functionality, while making activity under the XWorm label less likely to represent a single, centrally controlled operation.
What defenders should prioritize
Organizations that detect XWorm should treat the affected Windows host as an interactive compromise, not merely as a system that executed a static malicious file. The reported functions mean an operator may have observed user activity, controlled authenticated browser tabs, activated sensors or launched further payloads.
Incident response should prioritize isolating the device, investigating processes and network activity associated with the infection, and reviewing actions performed through active browser sessions. Authenticated sessions exposed on the system should be terminated, with credentials reset from a trusted device where appropriate.
Because Netskope’s account describes control of existing sessions, enabling MFA remains useful but is not a complete response to an infected endpoint. Preventing and detecting the initial compromise—and invalidating sessions after containment—are central to limiting the practical impact of XWorm’s expanded surveillance capabilities.
