XWorm RAT Evolves Into Surveillance Platform
XWorm RAT adds surveillance plugins for location, audio, and browser session hijacking.
Run Netskope?
Get an email when a reviewed story names Netskope, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
The XWorm RAT has evolved into a sophisticated surveillance platform with new plugins enabling location tracking, live audio streaming, and interactive control over authenticated browser sessions. The malware's capabilities have expanded significantly since its builder and source code were leaked, leading to increased activity and new variants.
The lesson from this incident
Full lessonThe XWorm Remote Access Trojan has grown far beyond its original capabilities after its builder and source code were publicly leaked, enabling threat actors of varying skill levels to deploy advanced variants with minimal effort. New plugins now allow attackers to perform real-time location tracking, stream live audio, and hijack authenticated browser sessions — representing a severe escalation in privacy and credential risk. The leak of source code dramatically lowers the barrier to entry for cybercriminals, accelerating the proliferation of new, customized variants. This matters because organizations and individuals may be unknowingly surveilled, with sensitive credentials and location data exfiltrated without obvious indicators. Early detection through behavioral monitoring is critical, as signature-based tools may fail to catch novel variants derived from the leaked code.
What helps against this
How we list vendors
- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Network detection and response (NDR)
Attackers moving between systems inside the network get seen.