# XWorm Leaked Builder Spawns Surveillance-Capable RAT Variants (V6.4, V6.5 'XWorm Reborn', V7.2, V7.4)

> Netskope Threat Labs reports that the leaked XWorm builder (cracked builder released June 2025; modified v6.4 source leaked August 2025) has fostered four concurrent versions (V6.4, V6.5 'XWorm Reborn', V7.2, V7.4) with confirmed plugins growing from 35 to 46. New capabilities include live browser session hijacking (HBrowser, abusing already-authenticated sessions to bypass MFA), GPS tracking (Maps) and live microphone capture. Netskope recorded 1,236 detection events across 100+ customer organizations in Q3 2026, a four-fold increase over Q3 2025.

- **Published:** 2026-10-14T06:59:03Z
- **Last reviewed:** 2026-10-14T06:59:03Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3475
- **ID:** TL-2026-3475
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)

## Description

XWorm is a commodity Windows remote access trojan first observed in 2022. In June 2025 a cracked version of the XWorm builder was released publicly, and in August 2025 the source code of a modified v6.4 leaked. Netskope Threat Labs (follow-up to its July 2025 analysis, which counted 35 plugins) now tracks four concurrent versions in the wild: V6.4 (file details referencing celestialproject.org), V6.5 branded 'XWorm Reborn' (c3lestial.fun branding, five new plugins, built-in license check), V7.2 (stronger code protection, native-code hiding, six anti-VM/anti-analysis checks, masquerading as Voicemod) and V7.4 (new dropper delivery via XBinder, bypass of Windows security monitoring including NTdll unhooking, a new C2 channel through the LocaltoNet tunneling service, and reinstated license checks). The confirmed plugin inventory is now 46.

The notable additions turn the RAT into a surveillance platform. HBrowser (available since version 6) gives the operator an interactive view of the victim's running browser: the operator sends keyboard, mouse, scroll and clipboard-paste input (keyboard and clipboard payloads base64-encoded, carried over XWorm's standard AES-encrypted C2 channel; example command format OpenBrowser<SPL>chrome<SPL><width><SPL><height>) while the infected endpoint executes the input and continuously returns screenshots. Because it operates inside an already logged-in session, it bypasses MFA and needs no stolen credentials. The Maps plugin uses the .NET GeoCoordinateWatcher to obtain GPS location, suppresses Windows location-consent prompts, and falls back to IP geolocation (ip-api.com/csv); location is returned with a GMapsapi<SPL><ID><SPL><lat>,<lon> message and needs no privilege escalation. The Microphone plugin uses NAudio WaveInEvent to capture 8 kHz, 16-bit mono audio in 500 ms buffers, gzip-compressed and base64-encoded, controlled by MICCM / CLOSEMIC / ENDMIC commands for near-real-time listening. Other plugins named in coverage include Webcam capture, Rootkit, ResetSurvival, Cmstp-Bypass (CMSTP UAC bypass), SteamTokenRecovery and HRDP (hidden remote desktop).

Infection methods reported by secondary coverage include phishing attachments, fake software installers (e.g. ScreenConnect, Discord lookalikes), LNK files, malicious JavaScript and PowerShell chains. Netskope recorded 1,236 detection events across 100+ customer organizations in Q3 2026 (601 in September 2026 alone), with ~35% of affected customers in financial services and concentration in India, Brazil, Italy, Panama and the United States. Samples are flagged as Gen:Variant.Application.Lazy and Trojan.Generic. Netskope states IOCs are published on GitHub; hashes were not available in the retrieved sources. The cited sources are not clear on actor attribution: this is crimeware used by multiple unrelated operators, so no single actor is attributed.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1547.001 Registry Run Keys / Startup Folder
- T1685 Disable or Modify Tools
- T1497.001 System Checks
- T1027 Obfuscated Files or Information
- T1036.005 Match Legitimate Resource Name or Location
- T1218.003 CMSTP
- T1014 Rootkit
- T1185 Browser Session Hijacking
- T1123 Audio Capture
- T1113 Screen Capture
- T1056.001 Keylogging
- T1614 System Location Discovery
- T1021.001 Remote Desktop Protocol
- T1573.001 Symmetric Cryptography
- T1090 Proxy

## Sources

- [How a leaked builder of XWorm turned a remote access trojan into a surveillance kit (Security Affairs)](https://securityaffairs.com/200910/malware/how-a-leaked-builder-of-xworm-turned-a-remote-access-trojan-into-a-surveillance-kit.html)
- [XWorm Reborn: From infostealer to surveillance platform (Netskope Threat Labs)](https://www.netskope.com/blog/xworm-reborn-from-infostealer-to-surveillance-platform)
- [XWorm RAT Evolves Into Surveillance Platform (SecurityWeek)](https://www.securityweek.com/xworm-rat-evolves-into-surveillance-platform/)
- [XWorm HBrowser Plugin Lets Attackers Control Authenticated Browser Sessions Without Credentials (GBHackers)](https://gbhackers.com/xworm-hbrowser-plugin/)
- [XWorm Malware Can Spy Through Your Microphone and Hijack Logged-In Browser Sessions (Cyber Security News)](https://cybersecuritynews.com/xworm-malware-2/)
- [XWorm Expands Surveillance and Browser Session Hijacking as Detections Quadruple (Mallory)](https://mallory.ai/stories/01a130b2-418c-73ef-9ca3-e8eba2c1df86)
- [XWorm Hijacks Authenticated Sessions to Bypass MFA (Cyberpress)](https://cyberpress.org/xworm-hijacks-authenticated-sessions/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3475