XWorm 6.0 Returns with 35+ Plugins and Enhanced Data Theft Capabilities

XWorm 6.0 has reappeared with a modular core and more than 35 DLL payloads that can be loaded into memory via a plugin command, according to Trellix. The analysis notes that XWorm’s plugins include RemoteDesktop.dll, WindowsUpdate.dll, Stealer.dll, Recovery.dll, and others designed to steal data, log keystrokes, capture screens, and even enable ransomware operations.

Campaigns distributing XWorm 6.0 used malicious JavaScript in phishing emails to display a decoy PDF while PowerShell injected the malware into a legitimate Windows process. Trellix says XWorm 6.0 connects to its C2 server at 94.159.113[.]64 on port 4411 and supports a workflow where the plugin is transferred from the server after the hash is checked, downloaded, decoded and loaded into memory.

The re-emergence was linked to a threat actor named XCoderTools offering XWorm 6.0 for $500 for lifetime access on cybercrime forums on 4 June 2025, with Trellix noting it as a “fully re-coded” version that fixes a previous RCE flaw.