Loading story…
XWorm is expanding from an information stealer into a surveillance and remote-control platform, with plugins that capture microphone and webcam activity, locate compromised Windows devices, and control authenticated browser sessions. Netskope Threat Labs tracked four versions operating concurrently and an increase from 35 to 46 confirmed plugins. Its HBrowser plugin operates the victim’s running browser, potentially allowing attackers to misuse logged-in accounts without triggering a new multifactor authentication challenge; it does not break MFA itself. Newer versions also incorporate additional evasion capabilities.
Netskope recorded 1,236 detection events across more than 100 customer organizations in Q3 2026, approximately four times the Q3 2025 volume; these counts do not establish the number of uniquely infected devices. Researchers linked the initial surge to the public leak of the XWorm V6.4 builder in mid-2025, with publicly released builders and modified source code contributing to increased activity that remains above pre-leak baselines. Financial services represented approximately 35% of affected customers, with activity concentrated in India, Brazil, Italy, Panama, and the United States. Defenders should investigate endpoint compromise and authenticated account misuse together rather than treating MFA as sufficient protection against session abuse.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
During Q3 2026, Netskope recorded 1,236 XWorm detection events across more than 100 customer organizations, approximately four times the Q3 2025 volume; these were not confirmed counts of uniquely infected devices. Financial services represented approximately 35% of affected customers, with activity concentrated in India, Brazil, Italy, Panama, and the United States.
Modified XWorm V6.4 source code appeared publicly in August 2025, following the cracked builder release. Netskope linked these releases to increased detection volumes that remained above earlier levels through 2026.
Netskope Threat Labs published an analysis of XWorm version 6.0 and its more advanced features in July 2025.
A cracked XWorm V6.4 builder appeared publicly in June 2025. Netskope attributed the initial surge in XWorm activity to this leak.
Netskope Threat Labs first reported on XWorm and its infection chain in September 2024.
Netskope identified V6.4, V6.5 “XWorm Reborn,” V7.2, and V7.4 operating in the wild and documented an increase from 35 to 46 confirmed plugins following its July 2025 report. Its findings detailed control of authenticated browser sessions, microphone and webcam capture, location-consent changes without a visible prompt, and newer evasion capabilities including V7.2 anti-virtual-machine checks and V7.4 NTdll unhooking.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
6 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourcesecurityaffairs.com
Open sourcecybersecuritynews.com
Open sourcesecurityweek.com
Open sourcenetskope.com
Open sourcethreatlabs.netskope.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
XWorm, a modular remote access trojan (RAT) first observed in 2022, has re-emerged in the threat landscape with significant enhancements in its latest versions, including 6.0, 6.4, and 6.5. The malware, originally developed by an individual known as XCoder, has evolved into a highly versatile tool capable of supporting a wide array of malicious activities on compromised Windows hosts. After XCoder abandoned the project and deleted their Telegram accounts, multiple threat actors began distributing cracked versions of XWorm, leading to a surge in its adoption and deployment. The new variants now support over 35 specialized plugins, enabling functionalities such as data theft from browsers and applications, keylogging, screen capture, clipboard monitoring, and even ransomware operations that can encrypt or decrypt files. XWorm’s modular design allows operators to issue commands from external servers, including downloading files, opening URLs, shutting down or restarting systems, and launching distributed denial-of-service (DDoS) attacks. The malware is primarily propagated through phishing emails and malicious websites, often using deceptive installers for legitimate software like ScreenConnect or Discord. Infection chains have been observed leveraging Windows shortcut (LNK) files and malicious JavaScript to execute PowerShell commands, sometimes bypassing Antimalware Scan Interface protections. The last version developed by XCoder, 5.6, contained a remote code execution vulnerability, which has been addressed in the newer releases. XWorm’s anti-analysis and anti-evasion mechanisms allow it to detect virtualized environments and cease execution to avoid detection. The malware’s popularity is underscored by campaigns that have resulted in tens of thousands of infections, with significant activity noted in countries such as Russia, the United States, India, Ukraine, and Turkey. Some threat actors have even used XWorm as a lure to target less-skilled cybercriminals, embedding backdoors to steal data from those attempting to use the malware. Security researchers, particularly from Trellix, have documented a marked increase in XWorm samples on platforms like VirusTotal since June, indicating widespread adoption among cybercriminals. The rapid evolution and prevalence of XWorm highlight the critical need for robust security measures, user awareness, and advanced detection capabilities to mitigate the risks posed by this adaptable malware. Organizations are advised to monitor for phishing campaigns, scrutinize suspicious attachments and downloads, and ensure endpoint protection solutions are updated to detect the latest XWorm variants. The ongoing development and distribution of XWorm by multiple actors suggest that it will remain a persistent threat in the cybercrime ecosystem.
Jun 29, 2026
Researchers reported that **XWorm**, a .NET-based Windows remote access trojan, has been both actively deployed in phishing attacks and marketed online as a builder for criminal operators. The malware has been advertised with modules for **RAT control, ransomware, HVNC, hidden RDP, DDoS, keylogging, credential theft, clipper functions, and persistence**, while incident analysis found live samples communicating with command-and-control servers such as `system6458[.]ddns[.]net` over port `6666`. Reverse engineering also showed that XWorm uses anti-analysis checks to terminate in virtualized or sandboxed environments and can persist through startup-folder copies, scheduled tasks, AppData placement, and registry autorun entries. Separate investigations tied XWorm to ongoing delivery campaigns, including the **MEME#4CHAN** phishing operation, which used fake hotel reservation lures and Microsoft Word documents exploiting `CVE-2022-30190` to launch multi-stage infection chains involving PowerShell, JScript, and in-memory .NET loading. Analysts found XWorm variants capable of **PowerShell execution, in-memory .NET execution, screenshots, plugin retrieval, USB spreading, uninstall functions, and DDoS**, with configuration fields such as `Host`, `Port`, and `KEY` encrypted using AES and derived keys. In some intrusions, the malware disabled **AMSI**, weakened Microsoft Defender, created a local administrator account named **System32**, disabled the Windows Firewall, and injected the final payload into processes including `RegSvcs.exe` and `Msbuild.exe`, with observed C2 infrastructure including `212.87.204[.]83:3000` and `port3000newspm.duckdns[.]org`.
Aug 15, 2026
Researchers reported that **XWorm** re-emerged with the release of **XWorm V6** after the malware had been widely considered abandoned, and that its latest campaigns used a modular plugin architecture to expand capabilities on infected Windows systems. In one observed chain, a malicious JavaScript file launched PowerShell, disabled AMSI, deployed an injector DLL, and injected the XWorm client into `RegSvcs.exe`, after which the malware contacted a command-and-control server at `94.159.113.64:4411`. The malware stored plugins in the registry and retrieved them on demand to enable remote desktop control, shell access, credential theft, browser data theft, file management, persistence, and ransomware activity; researchers also linked some browser-theft components to public proof-of-concept code designed to bypass Chrome v20 protections. Separate reporting found that threat actors were circulating a **trojanized XWorm builder**, underscoring infighting in the cybercrime ecosystem and showing that some operators and would-be customers were themselves being infected. Trellix likewise observed cracked and modified XWorm V6 builders, including leaked **V6.4** variants containing `Rootkit.dll` and `ResetSurvival.dll`, and said some builders and operators had been compromised by XWorm malware. The malware’s persistence methods included logon scripts, **Run** keys, and abuse of `ResetConfig.xml`, while operators also deployed payloads such as **DarkCloud Stealer**, **Remcos RAT**, and other stealers; its ransomware plugin used **AES-CBC**, dropped a ransom note, changed the victim’s wallpaper, and showed code overlap with **NoCry** ransomware.
Aug 14, 2026