Threat reportMalwareTL-2026-3434
XWorm RAT (V6.4-V7.4): Microphone Surveillance and Logged-In Browser Session Hijacking
XWorm RAT (V6.4-V7.4) (TL-2026-3434), also tracked as XWorm Reborn, is a high-severity malware campaign, first published 2026-10-13. It has no confirmed attribution, affects Microsoft Windows (endpoints), maps to 16 MITRE ATT&CK techniques (T1014, T1059.001, T1059.007), and is covered by 9 detection rules and 18 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 16MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 18Indicators of compromise
Key facts for TL-2026-3434
- Threat ID
- TL-2026-3434
- Also known as
- XWorm Reborn, XWorm V6.5, XCoderTools XWorm
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- financial services, general enterprise
- Target regions
- india, brazil, italy, panama, united states of america
- Detection rules
- 9
- Indicators of compromise
- 18
Malware and tooling in XWorm RAT (V6.4-V7.4)
Malware and tooling: XWorm, LocaltoNet, NAudio, XBinder
How XWorm RAT (V6.4-V7.4) works
XWorm, a commercial modular .NET RAT, has grown from 35 to 46 plugins since July 2025, adding HBrowser remote control of authenticated browser sessions, NAudio-based microphone capture and location tracking. V7.2+ adds rootkit functionality and anti-VM checks; V7.4 adds NTdll unhooking and LocaltoNet C2 tunneling. Netskope-sourced reporting counts 1,236 detection events across 100+ customer organizations in Q3 2026, about four times Q3 2025.
XWorm is a malware-as-a-service remote access trojan first observed in 2022. Its original developer (XCoder) reportedly abandoned the project after V5.6, which was vulnerable to RCE; successor builds (V6.0, V6.4, V6.5 "XWorm Reborn", V7.2, V7.4) are advertised by "XCoderTools" and have been adopted by multiple unrelated threat actors. A public builder release (June 2025) and a source-code leak (August 2025), as described in the source article, drove a sharp rise in detections. No threat actor attribution is stated in any source.
The latest reporting (Cyber Security News summarising Netskope Threat Labs, 2026-10-13) documents growth from 35 to 46 plugins since July 2025. New capabilities: (1) HBrowser, which lets the operator drive an authenticated victim browser session remotely (OpenBrowser/CloseHBrowser commands, screenshot relay, mouse and keyboard input via keyboardClick, LeftDown/LeftUp, MoveCursor, ScrollUp/ScrollDown, and clipboard paste) so that MFA and session state are inherited rather than stolen; (2) a Microphone plugin using the NAudio library's WaveInEvent at 8 kHz, 16-bit mono in 500 ms buffers, controlled with MICCM (list devices), MICGET (stream audio), CLOSEMIC and ENDMIC; (3) a Maps plugin that retrieves location through the GMapsapi command, working with the Windows location consent store registry key (HKCU\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\location) and falling back to IP geolocation via ip-api.com; and (4) Webcam on-demand video capture. Additional plugins named in V6.4+ include Rootkit, SteamTokenRecovery, HRDP, Cmstp-Bypass and ResetSurvival.
Version-specific changes: V7.2 adds native-code hiding (rootkit) and six anti-VM checks; V7.4 adds the XBinder dropper, NTdll unhooking (loading a clean ntdll.dll to bypass EDR hooks) and C2 tunneling through the LocaltoNet service. Branding strings link builds to c3lestial.fun (USB drop name "XWorm V6.5 by c3lestial.fun") and celestialproject.org (V6.4 PE metadata). Earlier reporting (Trellix, BleepingComputer, 2025) documents delivery via malicious JavaScript launching PowerShell (with AMSI bypass), LNK email attachments, fake Discord executables, modified ScreenConnect, XLAM shellcode and AI-themed lures, plus a Ransomware.dll module (AES-256-CBC, .ENC extension, NoCry code overlap) and stealer plugins (Stealer.dll, Chromium.dll, Recovery.dll) covering 35+ browsers, mail clients, messengers, FTP clients and crypto wallets.
Q3 2026 telemetry cited in the source: 1,236 events across 100+ organizations; about 35% of affected customers in financial services; concentration in India, Brazil, Italy, Panama and the United States. Severity is an analyst assessment (no CVSS applies). The source article states no hashes, IPs or CVEs.
MITRE ATT&CK techniques used in TL-2026-3434
Defense Evasion
T1014 Rootkit; T1218.003 CMSTP; T1497.001 System Checks
Execution
T1059.001 PowerShell; T1059.007 JavaScript; T1204.002 Malicious File
Command and Control
T1090 Proxy; T1219 Remote Access Tools
Collection
T1113 Screen Capture; T1123 Audio Capture; T1125 Video Capture; T1185 Browser Session Hijacking
Credential Access
T1555.003 Credentials from Web Browsers
Initial Access
T1566.001 Spearphishing Attachment
Discovery
T1614 System Location Discovery
defense-impairment
Affected products and versions in XWorm RAT (V6.4-V7.4)
- Microsoft — Windows (endpoints)
Vulnerable versions: Windows endpoints running .NET-capable user sessions
Remediation for XWorm RAT (V6.4-V7.4)
Immediate actions
- Hunt for XWorm plugin names, MICCM/MICGET/CLOSEMIC/ENDMIC and OpenBrowser/CloseHBrowser strings in memory and EDR telemetry
- Block and alert on DNS/HTTP to c3lestial.fun and celestialproject.org and review egress to ip-api.com from non-browser processes
- Alert on non-browser processes querying the CapabilityAccessManager ConsentStore location and microphone keys
- Review proxy/DNS logs for LocaltoNet tunneling endpoints from workstations
- Revoke and re-issue sessions/tokens for users on hosts where XWorm is confirmed
Workarounds
- Disable or restrict microphone and location access for desktop apps via policy
- Block LNK, JS and XLAM attachments at the mail gateway
Longer-term hardening
- Deploy EDR with detection for ntdll.dll unhooking and reflective/in-memory .NET loading
- Restrict script hosts (wscript/cscript/PowerShell) for standard users and enforce AMSI and script block logging
- Use phishing-resistant MFA and short session lifetimes, with device-bound session tokens, to limit hijacked-session value
- Restrict tunneling and remote-access tooling by egress policy
Timeline of XWorm RAT (V6.4-V7.4)
- XWorm first observed as a commercial RAT (year-level date per reporting: 2022).
- Public XWorm builder released and VirusTotal sample volume rises (month-level date: June 2025).
- Netskope Threat Labs original XWorm report documents 35 plugins (month-level date: July 2025).
- XWorm source code leaked, further increasing detections (month-level date: August 2025).
- Trellix reports evolved XWorm V6 infection chains and plugin analysis (month-level date: September 2025).
- Start of Q3 2026 period in which 1,236 detection events across 100+ customer organizations were recorded, about 4x Q3 2025.
- Cyber Security News publishes report on XWorm growth to 46 plugins, HBrowser session hijacking and microphone capture.
Sources cited for XWorm RAT (V6.4-V7.4)
- XWorm Malware Can Spy Through Your Microphone and Hijack Logged-In Browser Sessions
- Netskope Threat Labs Uncovers New XWorm's Stealthy Techniques
- XWorm V6.0: Enhanced Malware Protection and Stealthy Delivery (Netskope)
- XWorm malware resurfaces with ransomware module, over 35 plugins (BleepingComputer)
- XWorm V6: Exploring Pivotal Plugins (Trellix)
- XWorm 2025 multiplugin ransomware campaign (Aviatrix)
- XWorm RAT analysis: Steal, persist, control (Logpoint)
- Analysis of XWorm RAT Campaign (LMNTRIX)
- ANY.RUN report: XWorm V6.5 by c3lestial.fun sample
Detection coverage for TL-2026-3434
As of 2026-10-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3434 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.