XWorm RAT Transforms Into Advanced Surveillance Threat

Post Views: 8

A cybersecurity firm’s analysis reveals that the XWorm remote access trojan (RAT) has undergone significant functional upgrades, transforming it into a comprehensive surveillance tool.

XWorm RAT Overview

First identified in 2022, XWorm is a Windows-based malware designed to grant attackers full control over compromised systems. Its core functionalities include keylogging, screenshot capture, webcam access, and execution of malicious payloads. The threat actors behind the malware have consistently updated its codebase, maintaining active operations with over 1,200 confirmed incidents across 100 organizations during the third quarter of the year.

Latest Developments

The latest developments involve an expansion of XWorm’s plugin ecosystem, increasing from 35 supported modules in July 2025 to 46 by October 2026. Several of these plugins are explicitly tailored for surveillance purposes, enabling features such as real-time location tracking, live audio interception, and remote control of authenticated browser sessions.

Surveillance Plugins

Maps Plugin

The Maps plugin, for instance, retrieves GPS coordinates of infected devices without requiring user consent.

Microphone Plugin

The Microphone plugin facilitates continuous audio streaming from the victim’s environment, while the HBrowser plugin allows operators to hijack active browser sessions without accessing stored credentials.

HBrowser Plugin

This capability bypasses multi-factor authentication (MFA) by directly interacting with the browser interface.

HBrowser Plugin Details

The integration of the HBrowser plugin marks a critical shift in XWorm’s attack methodology. Instead of extracting credentials, the malware provides operators with a live, interactive view of the victim’s browser. All user inputs are encoded as command-and-control (C&C) commands and transmitted through XWorm’s AES-encrypted communication channel. The victim’s system executes these commands on the active browser window, while the operator receives a continuous feed of screenshots. This process enables full access to authenticated tabs without requiring login interactions or MFA verification.

Proliferation Factors

The proliferation of XWorm’s surveillance capabilities coincides with the public release of a cracked builder tool in June 2025 and the subsequent leak of the RAT’s 6.4 version source code in August 2025. These events have likely contributed to the malware’s increased prevalence and adaptability.

Security Researchers’ Note

The Maps and Microphone plugins further enhance the threat’s stealth by allowing operators to monitor victims’ physical locations and audio environments without triggering privilege escalation alerts or user prompts. Security researchers note that the leaked builder and source code have accelerated the malware’s evolution, with developers continuously refining its functionality.

Cybercrime Trend

The integration of surveillance tools underscores a broader trend in cybercrime, where attackers prioritize persistent, low-visibility monitoring over traditional data exfiltration methods.

Conclusion

As XWorm’s capabilities expand, organizations are advised to strengthen endpoint detection mechanisms and monitor for anomalous network traffic associated with RAT activity.