# XWorm RAT (V6.4-V7.4): Microphone Surveillance and Logged-In Browser Session Hijacking

> XWorm, a commercial modular .NET RAT, has grown from 35 to 46 plugins since July 2025, adding HBrowser remote control of authenticated browser sessions, NAudio-based microphone capture and location tracking. V7.2+ adds rootkit functionality and anti-VM checks; V7.4 adds NTdll unhooking and LocaltoNet C2 tunneling. Netskope-sourced reporting counts 1,236 detection events across 100+ customer organizations in Q3 2026, about four times Q3 2025.

- **Published:** 2026-10-13T18:27:13Z
- **Last reviewed:** 2026-10-13T18:27:13Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3434
- **ID:** TL-2026-3434
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)

## Description

XWorm is a malware-as-a-service remote access trojan first observed in 2022. Its original developer (XCoder) reportedly abandoned the project after V5.6, which was vulnerable to RCE; successor builds (V6.0, V6.4, V6.5 "XWorm Reborn", V7.2, V7.4) are advertised by "XCoderTools" and have been adopted by multiple unrelated threat actors. A public builder release (June 2025) and a source-code leak (August 2025), as described in the source article, drove a sharp rise in detections. No threat actor attribution is stated in any source.

The latest reporting (Cyber Security News summarising Netskope Threat Labs, 2026-10-13) documents growth from 35 to 46 plugins since July 2025. New capabilities: (1) HBrowser, which lets the operator drive an authenticated victim browser session remotely (OpenBrowser/CloseHBrowser commands, screenshot relay, mouse and keyboard input via keyboardClick, LeftDown/LeftUp, MoveCursor, ScrollUp/ScrollDown, and clipboard paste) so that MFA and session state are inherited rather than stolen; (2) a Microphone plugin using the NAudio library's WaveInEvent at 8 kHz, 16-bit mono in 500 ms buffers, controlled with MICCM (list devices), MICGET (stream audio), CLOSEMIC and ENDMIC; (3) a Maps plugin that retrieves location through the GMapsapi command, working with the Windows location consent store registry key (HKCU\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\location) and falling back to IP geolocation via ip-api.com; and (4) Webcam on-demand video capture. Additional plugins named in V6.4+ include Rootkit, SteamTokenRecovery, HRDP, Cmstp-Bypass and ResetSurvival.

Version-specific changes: V7.2 adds native-code hiding (rootkit) and six anti-VM checks; V7.4 adds the XBinder dropper, NTdll unhooking (loading a clean ntdll.dll to bypass EDR hooks) and C2 tunneling through the LocaltoNet service. Branding strings link builds to c3lestial.fun (USB drop name "XWorm V6.5 by c3lestial.fun") and celestialproject.org (V6.4 PE metadata). Earlier reporting (Trellix, BleepingComputer, 2025) documents delivery via malicious JavaScript launching PowerShell (with AMSI bypass), LNK email attachments, fake Discord executables, modified ScreenConnect, XLAM shellcode and AI-themed lures, plus a Ransomware.dll module (AES-256-CBC, .ENC extension, NoCry code overlap) and stealer plugins (Stealer.dll, Chromium.dll, Recovery.dll) covering 35+ browsers, mail clients, messengers, FTP clients and crypto wallets.

Q3 2026 telemetry cited in the source: 1,236 events across 100+ organizations; about 35% of affected customers in financial services; concentration in India, Brazil, Italy, Panama and the United States. Severity is an analyst assessment (no CVSS applies). The source article states no hashes, IPs or CVEs.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1059.007 JavaScript
- T1014 Rootkit
- T1685 Disable or Modify Tools
- T1497.001 System Checks
- T1218.003 CMSTP
- T1555.003 Credentials from Web Browsers
- T1614 System Location Discovery
- T1185 Browser Session Hijacking
- T1123 Audio Capture
- T1125 Video Capture
- T1113 Screen Capture
- T1090 Proxy
- T1219 Remote Access Tools

## Sources

- [XWorm Malware Can Spy Through Your Microphone and Hijack Logged-In Browser Sessions](https://cybersecuritynews.com/xworm-malware-2/)
- [Netskope Threat Labs Uncovers New XWorm's Stealthy Techniques](https://www.netskope.com/blog/netskope-threat-labs-uncovers-new-xworms-stealthy-techniques)
- [XWorm V6.0: Enhanced Malware Protection and Stealthy Delivery (Netskope)](https://www.netskope.com/jp/blog/xworm-v6-0-enhanced-malware-protection-and-stealthy-delivery)
- [XWorm malware resurfaces with ransomware module, over 35 plugins (BleepingComputer)](https://www.bleepingcomputer.com/news/security/xworm-malware-resurfaces-with-ransomware-module-over-35-plugins/)
- [XWorm V6: Exploring Pivotal Plugins (Trellix)](https://trellix.com/blogs/research/xworm-v6-exploring-pivotal-plugins)
- [XWorm 2025 multiplugin ransomware campaign (Aviatrix)](https://aviatrix.ai/threat-research-center/xworm-malware-2025-multiplugin-ransomware-campaign/)
- [XWorm RAT analysis: Steal, persist, control (Logpoint)](https://logpoint.com/en/blog/xworm-rat-analysis-steal-persist-control)
- [Analysis of XWorm RAT Campaign (LMNTRIX)](https://lmntrix.com/blog/analysis-of-xworm-rat-campaign/)
- [ANY.RUN report: XWorm V6.5 by c3lestial.fun sample](https://any.run/report/81f65a7b38aca0066dffa6766db2cc839b1b9a23cbcdcc6b8515ddded7063f59/db0fc843-eb2d-4264-b9c5-c6bcad2ac731)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3434