XWorm RAT Evolves Into Surveillance Platform

XWorm RAT, first observed in 2022, is a multi-functional malware targeting Windows systems that provides attackers with full control, including keylogging, screenshot capture, webcam access, and payload execution. Recently, its developers expanded its plugin count from 35 to 46, adding surveillance-focused features such as GPS location tracking without user prompts, live audio streaming, webcam capture on demand, and a novel HBrowser plugin that hijacks authenticated browser sessions bypassing MFA. The HBrowser plugin encodes attacker inputs as command-and-control commands executed on the victim’s active browser window, providing a real-time remote browser session view. The malware’s activity increased after a cracked builder was released in June 2025 and the source code leaked in August 2025. XWorm communicates over AES-encrypted channels and remains highly active with over 1,200 incidents observed across 100 organizations in Q3 2026. No vendor advisory or patch information is available.

The malware enables attackers to conduct extensive surveillance and control over infected Windows systems, including stealthy location tracking, live audio capture, webcam monitoring, and real-time interaction with authenticated browser sessions bypassing multi-factor authentication. This level of access can lead to significant privacy violations, data theft, and unauthorized system control. The increased activity and availability of cracked tools and source code suggest a growing threat landscape.

No official patch or remediation guidance is provided in the source information. Organizations should monitor for indicators of compromise related to XWorm and employ endpoint detection and response solutions capable of identifying RAT behaviors. Given the lack of vendor advisories, patch status is not yet confirmed—check with security vendors and threat intelligence sources for updates. Standard security controls such as restricting execution of unauthorized software and network segmentation may help limit exposure but are not specific mitigations for this malware.