NETSKOPE Threat Labs has been monitoring XWorm since September 2024, and its latest findings show the malware evolving into a sophisticated, multi-version toolkit. Over the past year four distinct XWorm versions have been observed circulating at the same time, alongside 46 plugins that expand its capabilities for location tracking, audio capture and live browser control.
Detections surged after a public leak of the XWorm builder in June 2025 and a leaked modified version, 6.4, in August 2025, with activity remaining well above pre-leak baselines into 2026. In the third quarter of 2026, detections totalled 1,236 across more than 100 organisations, four times higher than the previous year, though a single month in September reached 601 detections, mirroring peak levels from earlier in the year. The affected sectors skew toward financial services (about 35%), with activity concentrated in India, Brazil, Italy, Panama and the United States.
The malware has moved from infostealer to a full surveillance platform. Four recent versions—V6.4, V6.5 (XWorm Reborn), V7.2 and V7.4—introduce new plugins and refined evasion techniques. Notable additions include Maps, Microphone and HBrowser, the latter providing live remote control of a victim’s browser session and streaming the screen back to the operator without requiring credential theft, effectively bypassing MFA during an active session.
Location tracking can suppress Windows consent prompts and fetch precise GPS coordinates within 15 seconds, with IP-based fallback if GPS is unavailable. The Microphone plugin streams selected audio in near real time, while HBrowser enables direct, live interaction with the victim’s open accounts. Indicators of compromise appear on GitHub, with samples flagged as Gen:Variant.Application[.]Lazy and Trojan[.]Generic. Netskope anticipates continued progression and upgrades driven by the public availability of the builder and source code.