Threat reportMalwareTL-2026-3475
XWorm Leaked Builder Spawns Surveillance-Capable RAT Variants (V6.4, V6.5 'XWorm Reborn', V7.2, V7.4)
XWorm Leaked Builder Spawns Surveillance-Capable RAT (TL-2026-3475), also tracked as XWorm Reborn, is a high-severity malware campaign, first published 2026-10-14. It has no confirmed attribution, affects Microsoft Windows, maps to 18 MITRE ATT&CK techniques (T1014, T1021.001, T1027), and is covered by 9 detection rules and 18 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 18MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 18Indicators of compromise
Key facts for TL-2026-3475
- Threat ID
- TL-2026-3475
- Also known as
- XWorm Reborn, XWorm V6.4, XWorm V6.5, XWorm V7.2, XWorm V7.4
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- financial services, technology, enterprise
- Target regions
- india, brazil, italy, panama, united states of america
- Detection rules
- 9
- Indicators of compromise
- 18
Malware and tooling in XWorm Leaked Builder Spawns Surveillance-Capable RAT
Malware and tooling: Gen:Variant.Application.Lazy, Trojan.Generic, XWorm, Cmstp-Bypass, HBrowser, HRDP, Maps, Microphone, ResetSurvival, SteamTokenRecovery, XBinder
How XWorm Leaked Builder Spawns Surveillance-Capable RAT works
Netskope Threat Labs reports that the leaked XWorm builder (cracked builder released June 2025; modified v6.4 source leaked August 2025) has fostered four concurrent versions (V6.4, V6.5 'XWorm Reborn', V7.2, V7.4) with confirmed plugins growing from 35 to 46. New capabilities include live browser session hijacking (HBrowser, abusing already-authenticated sessions to bypass MFA), GPS tracking (Maps) and live microphone capture. Netskope recorded 1,236 detection events across 100+ customer organizations in Q3 2026, a four-fold increase over Q3 2025.
XWorm is a commodity Windows remote access trojan first observed in 2022. In June 2025 a cracked version of the XWorm builder was released publicly, and in August 2025 the source code of a modified v6.4 leaked. Netskope Threat Labs (follow-up to its July 2025 analysis, which counted 35 plugins) now tracks four concurrent versions in the wild: V6.4 (file details referencing celestialproject.org), V6.5 branded 'XWorm Reborn' (c3lestial.fun branding, five new plugins, built-in license check), V7.2 (stronger code protection, native-code hiding, six anti-VM/anti-analysis checks, masquerading as Voicemod) and V7.4 (new dropper delivery via XBinder, bypass of Windows security monitoring including NTdll unhooking, a new C2 channel through the LocaltoNet tunneling service, and reinstated license checks). The confirmed plugin inventory is now 46.
The notable additions turn the RAT into a surveillance platform. HBrowser (available since version 6) gives the operator an interactive view of the victim's running browser: the operator sends keyboard, mouse, scroll and clipboard-paste input (keyboard and clipboard payloads base64-encoded, carried over XWorm's standard AES-encrypted C2 channel; example command format OpenBrowser<SPL>chrome<SPL><width><SPL><height>) while the infected endpoint executes the input and continuously returns screenshots. Because it operates inside an already logged-in session, it bypasses MFA and needs no stolen credentials. The Maps plugin uses the .NET GeoCoordinateWatcher to obtain GPS location, suppresses Windows location-consent prompts, and falls back to IP geolocation (ip-api.com/csv); location is returned with a GMapsapi<SPL><ID><SPL><lat>,<lon> message and needs no privilege escalation. The Microphone plugin uses NAudio WaveInEvent to capture 8 kHz, 16-bit mono audio in 500 ms buffers, gzip-compressed and base64-encoded, controlled by MICCM / CLOSEMIC / ENDMIC commands for near-real-time listening. Other plugins named in coverage include Webcam capture, Rootkit, ResetSurvival, Cmstp-Bypass (CMSTP UAC bypass), SteamTokenRecovery and HRDP (hidden remote desktop).
Infection methods reported by secondary coverage include phishing attachments, fake software installers (e.g. ScreenConnect, Discord lookalikes), LNK files, malicious JavaScript and PowerShell chains. Netskope recorded 1,236 detection events across 100+ customer organizations in Q3 2026 (601 in September 2026 alone), with ~35% of affected customers in financial services and concentration in India, Brazil, Italy, Panama and the United States. Samples are flagged as Gen:Variant.Application.Lazy and Trojan.Generic. Netskope states IOCs are published on GitHub; hashes were not available in the retrieved sources. The cited sources are not clear on actor attribution: this is crimeware used by multiple unrelated operators, so no single actor is attributed.
MITRE ATT&CK techniques used in TL-2026-3475
Defense Evasion
T1014 Rootkit; T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1218.003 CMSTP; T1497.001 System Checks
Lateral Movement
T1021.001 Remote Desktop Protocol
Collection
T1056.001 Keylogging; T1113 Screen Capture; T1123 Audio Capture; T1185 Browser Session Hijacking
Execution
T1059.001 PowerShell; T1204.002 Malicious File
Command and Control
T1090 Proxy; T1573.001 Symmetric Cryptography
Persistence
T1547.001 Registry Run Keys / Startup Folder
Initial Access
T1566.001 Spearphishing Attachment
Discovery
T1614 System Location Discovery
defense-impairment
Affected products and versions in XWorm Leaked Builder Spawns Surveillance-Capable RAT
- Microsoft — Windows
Vulnerable versions: Windows endpoints (user-mode RAT; no OS vulnerability exploited)
Remediation for XWorm Leaked Builder Spawns Surveillance-Capable RAT
Immediate actions
- Block celestialproject.org, c3lestial.fun and unsanctioned LocaltoNet tunnel traffic at DNS/proxy
- Hunt endpoints for XWorm plugin command strings (MICCM, CLOSEMIC, ENDMIC, GMapsapi, OpenBrowser) and for binaries impersonating Voicemod
- Isolate hosts with confirmed XWorm detections and revoke/re-issue active web sessions and tokens for users of those hosts
Workarounds
- Disable microphone and location access by policy on managed Windows endpoints where not required
- Block LNK/JS attachments from email and constrain PowerShell with Constrained Language Mode and logging
Longer-term hardening
- Enforce phishing-resistant, device-bound authentication and short session lifetimes to limit value of hijacked logged-in sessions
- Deploy EDR with behavioral coverage for NTdll unhooking, CMSTP abuse and hidden remote desktop activity
- Restrict installation of remote-access and tunneling tools via application control
Timeline of XWorm Leaked Builder Spawns Surveillance-Capable RAT
- XWorm RAT first observed in the wild (2022; exact date not stated in sources)
- Cracked XWorm builder released publicly (June 2025; day not stated)
- Netskope's earlier XWorm analysis counted 35 plugins (July 2025; day not stated)
- Source code of a modified XWorm v6.4 leaked (August 2025; day not stated)
- 601 Netskope detection events recorded in September 2026 alone
- Q3 2026 closes with 1,236 detection events across 100+ customer organizations, a four-fold increase over Q3 2025
- Netskope Threat Labs publishes 'XWorm Reborn' follow-up: four concurrent versions and 46 confirmed plugins incl. HBrowser, Maps, Microphone; SecurityWeek covers it
- Security Affairs and other outlets publish coverage of XWorm surveillance capabilities
Sources cited for XWorm Leaked Builder Spawns Surveillance-Capable RAT
- How a leaked builder of XWorm turned a remote access trojan into a surveillance kit (Security Affairs)
- XWorm Reborn: From infostealer to surveillance platform (Netskope Threat Labs)
- XWorm RAT Evolves Into Surveillance Platform (SecurityWeek)
- XWorm HBrowser Plugin Lets Attackers Control Authenticated Browser Sessions Without Credentials (GBHackers)
- XWorm Malware Can Spy Through Your Microphone and Hijack Logged-In Browser Sessions (Cyber Security News)
- XWorm Expands Surveillance and Browser Session Hijacking as Detections Quadruple (Mallory)
- XWorm Hijacks Authenticated Sessions to Bypass MFA (Cyberpress)
Detection coverage for TL-2026-3475
As of 2026-10-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3475 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.