Science & Tech · Cybersecurity · 2 hrs ago
XWorm malware adds tools for tracking, listening and browser control
XWorm is malware that gives attackers control of infected Windows computers.
Its developers have added plugins that let operators track a victim’s location, stream audio, capture webcam images and control an active browser session.
The browser tool can access authenticated tabs without entering passwords or completing multi-factor authentication.
Netskope recorded more than 1,200 incidents across 100 organizations in the third quarter, and the number of supported plugins grew from 35 in July 2025 to 46 in October 2026.
A cracked builder was released publicly in June 2025, and XWorm source code was leaked two months later.
Netskope expects further upgrades and continued use of the malware, making its expanding surveillance tools a continuing security concern.
XWorm malware has added plugins for location tracking, live audio streaming, webcam capture and interactive control of authenticated browser sessions.
Cybersecurity firm Netskope reported that the Windows remote access trojan had expanded into a surveillance platform.
Netskope observed more than 1,200 XWorm incidents across 100 organizations in the third quarter of 2026.
The malware supported 46 plugins in October 2026, up from 35 in July 2025.
Netskope linked increased XWorm activity to the public release of a cracked builder and a leak of the malware’s source code in 2025.
- Who
- XWorm developers have added the new capabilities; Netskope reported on them.
- What
- XWorm added plugins for surveillance and interactive control of authenticated browser sessions.
- When
- Netskope reported the changes on October 13, 2026. It observed more than 1,200 incidents in the third quarter of 2026.
- Where
- The malware targets Windows systems; the incidents were across 100 organizations. Their locations are not stated.
- Why
- The plugins enable operators to track location, capture audio and webcam images, and control browser sessions. The developers’ motive is not stated.
This story does not have two clearly opposing sides.
XWorm was first observed.
A cracked version of the XWorm builder was released publicly.
XWorm supported 35 plugins.
The source code for XWorm version 6.4 was leaked.
Netskope observed more than 1,200 incidents across 100 organizations.
XWorm supported 46 plugins, including new surveillance capabilities.
- Malware
- XWorm, a Windows remote access trojan
- Incidents
- More than 1,200 across 100 organizations in the third quarter of 2026
- Plugin count
- 46 in October 2026; 35 in July 2025
- New capabilities
- Location tracking, live audio streaming, webcam capture and browser-session control
- Builder release
- Cracked version released publicly in June 2025
- Source code leak
- Version 6.4 leaked in August 2025
What people are saying
The Maps plugin provides victims’ GPS location without a user prompt. The Microphone plugin streams live audio from the victim’s device. HBrowser hijacks authenticated browser sessions without touching credentials, bypassing MFA entirely. Webcam capture is also available on demand,
XWorm continues to evolve and has now added surveillance capabilities. Since its builder and source code were leaked, we expect continued upgrades and use of this toolkit,
Sources
Related news
Ahold Delhaize takes some systems offline after cyberattack
Cyberattack overheats refrigeration systems in hundreds of French supermarkets
Cyberattack Defrosts Refrigerators at Hundreds of French Supermarkets
Cyberattack disrupts systems at TFG’s three UK fashion brands
GitLab urges self-managed users to patch critical code execution flaw
Ridge Security launches on-site AI penetration testing system
French supermarket hack raises concerns about smart home devices
Hackers take control of cooling units at 350 French supermarkets
Canadian cybersecurity executive arrested on federal extortion charges
