XWorm RAT evolves into surveillance platform with 46 plugins

XWorm RAT developers have expanded the malware into a surveillance platform, adding plugins for GPS tracking, live microphone streaming, webcam capture and hijacking authenticated browser sessions while bypassing MFA. Netskope observed over 1,200 incidents across 100 organizations in Q3.

• XWorm plugin count grew from 35 in July 2025 to 46 in October 2026
• HBrowser plugin hijacks authenticated browser sessions, bypassing MFA
• Netskope logged 1,200+ incidents across 100 organizations in Q3
• Leaked builder and version 6.4 source code accelerated the RAT's spread