SECURITYWEEK reports that the XWorm remote access trojan (RAT) has been expanded into a full surveillance platform, with the developer community adding new plugins to broaden its capabilities. The threat, first seen in 2022, now supports 46 plugins (up from 35 in July 2025), enabling location tracking, live audio streaming, webcam capture, and interactive control over authenticated browser sessions.
Netskope notes that the Maps plugin extracts victims’ GPS location without user prompts, while the Microphone plugin streams live audio from the infected device. The new HBrowser plugin allows operators to view and manipulate an active, authenticated browser session without touching credentials, effectively bypassing MFA in practice.
According to Netskope Threat Labs, activity around XWorm surged after a cracked builder was released publicly in June 2025 and the RAT’s source code for version 6.4 leaked in August 2025. Operators issue commands via standard XWorm C&C over an AES-encrypted channel; these commands drive input into the victim’s active browser and relay continuous screenshots back to the operator, delivering what is described as a real-time remote browser session.
In addition to credential harvesting, the Maps and Microphone plugins enable location and audio surveillance without privilege escalation or user prompts, while HBrowser expands the attacker’s visibility beyond traditional data theft. Netskope cautions that, since the leaked code and builder, continued upgrades and use of the toolkit are expected. In the third quarter of 2026, Netskope observed over 1,200 XWorm incidents across about 100 organisations.