Loading malware…
XWorm is a modular remote access trojan targeting Windows, first observed in 2022. Originally developed by an actor known as XCoder, it enables unauthorized remote control, credential theft, keylogging, screenshot capture, webcam access, and execution of additional payloads. Its plugin ecosystem expanded from 35 documented features in July 2025 to 46 by October 2026, including surveillance tools and a ransomware module with code overlapping NoCry ransomware. Public release of a cracked builder in June 2025 and modified version 6.4 source code in August 2025 contributed to wider dissemination.
XWorm's HBrowser plugin provides interactive control of a victim's running browser, streaming screenshots and relaying mouse and keyboard actions through an AES-encrypted command-and-control channel. This allows attackers to abuse existing authenticated sessions without extracting passwords or completing a fresh multifactor authentication challenge; it does not defeat MFA itself. The Microphone plugin streams captured audio from an operator-selected recording device. The Maps plugin changes Windows location-consent settings, attempts to obtain GPS coordinates, and falls back to IP-based geolocation. Microphone and location collection can operate without privilege escalation or visible permission prompts, and webcam capture is available on demand.
XWorm has been delivered through phishing attachments, malicious scripts, exploitation chains, malware loaders including 2CLoader, and compromised ScreenConnect infrastructure. Observed payloads support persistence, USB propagation, and Windows Defender exclusions. Recent variants add stronger code protection, anti-virtual-machine checks, native-code hiding, and security-monitoring evasion through unhooking. TA558 has deployed XWorm in its SteganoAmor campaigns using malicious Office documents, CVE-2017-11882, steganography, and staged scripts. Its use spans multiple countries and industries, with financial services prominently represented in observed 2026 activity.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
7 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
A 2026 XWorm v7.1 chain used a phishing email with a booby-trapped archive that exploited a WinRAR path-traversal flaw, CVE-2025-8088. | “Its design is modular, with more than 35 plugins, including a ransomware module that overlaps in code with NoCry ransomware.”
CVE-2024-1709 (CWE-288) — Authentication Bypass Using Alternate Path or Channel. Base CVSS score of 10, indicating “Critical”.
CVE-2024-1708 (CWE-22) — Improper Limitation of a Pathname to a Restricted Directory (“Path Traversal”). Base CVSS score of 8.4, still considered “High Priority”.
The group continues to exploit the fairly old CVE-2017-11882 in its attack chain. It uses steganography, an obfuscation technique, inside the chains to spread well-known malware used in other attacks in recent years.
Rather than using macros to execute malicious VBscript, this document uses a known vulnerability from last year (CVE-2022-30190). In summary, this vulnerability works by embedding external objects contained in a relationship file within the .docx word file. | The attack campaign (tracked by Securonix as MEME#4CHAN) was leveraging rather unusual meme-filled PowerShell code, followed by a heavily obfuscated XWorm payload to infect its victims.
Recent Xworm campaigns have leveraged multiple file formats and scripting languages, including PowerShell, VBS, HTA, and Office macro exploits such as CVE-2018-0802, to stage payloads and evade endpoint defenses. | Xworm followed closely with 183 uploads... continuing its reputation as a highly adaptable, modular RAT sold through malware-as-a-service channels.
Tearing apart a .NET crypter to extract dual XWorm RAT payloads, then decompiling the RAT to find a UEFI bootkit with BlackLotus DBX bypass, an r77 rootkit, driver infection, CVE-2026-20817 zero-day UAC bypass, and D/Invoke API evasion.
14 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Persistence is achieved into the machine using a malware build detected as XWorm.
NullBulge ... reportedly uses publicly available tools ... like Async RAT and Xworm before delivering LockBit payloads built using the leaked Lockbit builder.
XWorm is among the most popular RATs, used by many threat actors including TA 558.
“Seqrite/Mallory attributed a look-alike sample (Tax_Assessment.exe + libsvcs.dll > XWorm/DcRAT) to Silver Fox with medium-to-high confidence.”
Utilisation de sites gouvernementaux brésiliens compromis pour héberger des infostealers déguisés en documents fiscaux ... et des backdoors (XWORM).
Panda was so kind to share the associated dll’s with me. And indeed, they turned out to be XWorm. Associated C2s: secoundxwormm.ddns[.]net freshinxworm.ddns[.]net
33 distinct techniques documented for this family, organized by ATT&CK tactic.
« Utilisation de sites gouvernementaux brésiliens compromis pour héberger des infostealers ... et des backdoors »
XWorm established persistence through a scheduled task, and its plugins were stored in the registry.
Preceding cmd.exe, the script log_66292_ca9.ps1 is executed using powershell.exe... Additionally, the binary supported PowerShell command execution.
The windowsHide option suppresses the command window while the payload runs.
The extracted VBA script... downloads and executes a malicious powershell script.
We execute the script using, WScript.exe "PAGO-ENVIO DOCUMENTOS FACTURA 4558.js".
XWorm established persistence through a scheduled task, and its plugins were stored in the registry.
The first payload is loaded into memory by PowerShell and acts as a loader for the second payload. Figure 11: Process injection.
After extracting the archive, it contains a heavily obfuscated JavaScript file... The script is obfuscated by a chain of tools.
La campagna malevola sfrutta il nome e l’identità visiva del Servizio Sanitario Nazionale... Il tema sanitario ... viene utilizzato come elemento di fiducia per convincere l’utente ad avviare il file ricevuto.
The first payload is loaded into memory by PowerShell and acts as a loader for the second payload. Figure 11: Process injection.
The custom DOTNET loader... inject[s] a payload into a signed microsoft binary via process hollowing... starts a process in a suspended state... unmap[s] the memory of the target process, writes the payload... and then resume[s] the thread.
The batch script executes the PowerShell script and deletes all other files and directories being dumped... the script deletes itself and other processed files.
The function `_Expand` decrypts the data using AES... The data read from dumped files is decrypted and loaded into memory.
“[The chain] then reached InstallUtil.exe, a signed Windows utility that can be abused to run malicious code.”
The script then uses Microsoft HTML Application Host (mshta) or base64-encoded PowerShell to execute a highly obfuscated command.
864 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Subscription-based Windows .NET RAT supporting surveillance, theft, and plugin-based extortion. Campaigns use phishing, malicious scripts, cracked software, and Telegram or Discord channels. The article links delivery to exploitation of CVE-2025-8088 and describes scheduled-task persistence and registry-stored plugins. Separately, a trojanized builder stole credentials from people running it.
XWorm provides remote control of compromised devices, keystroke logging, screenshot capture, and remote payload execution. Its expanded plugin collection supports location tracking, microphone and webcam surveillance, and interaction with already authenticated browser sessions through the HBrowser plugin. It uses AES-encrypted command-and-control communications, while recent variants incorporate stronger code protection and virtual-environment evasion. Following the release of its cracked builder and version 6.4 source code in August 2025, researchers observed versions V6.4, V6.5, V7.2, and V7.4 in the wild. Netskope recorded 1,236 detection events across 100 customer organisations in Q3 2026, four times the corresponding 2025 total.
XWorm is a remote access trojan with information-stealing and surveillance capabilities. Its HBrowser plugin lets attackers control a victim’s live browser and access authenticated accounts without extracting credentials or completing a new MFA challenge. Maps obtains GPS or IP-based location and suppresses Windows location-consent prompts; Microphone streams encrypted audio without a visible prompt or privilege escalation. Webcam capture is also supported. Public leaks of a cracked builder in June 2025 and modified V6.4 source code in August 2025 contributed to increased activity. The report covers V6.4, V6.5 (XWorm Reborn), V7.2 and V7.4, with 46 known plugin features and newer capabilities for analysis evasion, security-monitoring bypass and payload delivery. Netskope recorded 1,236 detection events across more than 100 customer organizations in Q3 2026, approximately four times the Q3 2025 volume.
Windows malware with an expanding plugin collection supporting remote browser control, microphone and webcam capture, and location tracking. Its HBrowser plugin lets attackers operate an already authenticated browser session, potentially avoiding a fresh MFA challenge rather than defeating MFA itself. Other plugins stream captured audio and obtain location through Windows location services or fallback IP geolocation. Researchers observed versions V6.4, V6.5, V7.2, and V7.4, with newer versions adding anti-virtual-machine checks, native-code hiding, NTdll unhooking, and tunneled control infrastructure. The report records 1,236 detection events across more than 100 customer organizations in Q3 2026; these are not counts of unique infected devices.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.