[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fKl8ynH7aYDPsVHBt-svcX7T9LwERKE2gF8ncFpp1I8I":3},{"article":4,"iocs":41,"watch_terms":42,"solutions":43,"lesson":135},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"bba255cc-fb47-4728-8691-1f9b692937df","XWorm RAT Evolves Into Surveillance Platform","xworm-rat-evolves-into-surveillance-platform-4aa5a9","Expanded plugin count allows the malware to monitor users’ location, stream live audio, and interact with authenticated browser sessions. The post XWorm RAT Evolves Into Surveillance Platform appeared first on SecurityWeek.","The XWorm RAT has evolved into a sophisticated surveillance platform with new plugins enabling location tracking, live audio streaming, and interactive control over authenticated browser sessions. The malware's capabilities have expanded significantly since its builder and source code were leaked, leading to increased activity and new variants.","XWorm RAT adds surveillance plugins for location, audio, and browser session hijacking.","https:\u002F\u002Fwww.securityweek.com\u002Fxworm-rat-evolves-into-surveillance-platform\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2023\u002F01\u002FCybersecurity_News-SecurityWeek.jpg","2026-10-13T11:13:10+00:00","2026-10-13T12:00:08.141464+00:00",8,[17,20],{"name":18,"type":19},"XWorm RAT","product",{"name":21,"type":22},"Netskope","vendor","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":23,"icon":25,"name":26,"slug":27},null,"Malware","malware",[29,34,36],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":35},{"id":23,"icon":25,"name":26,"slug":27},{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[21,18],{"controls":44,"vendors":129},[45,74,100],{"slug":46,"name":47,"problem":48,"products":49},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[50,58,66],{"vendor_slug":51,"vendor_name":52,"vendor_logo":53,"product_slug":54,"product_name":55,"url":56,"description":57},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"slug":75,"name":76,"problem":77,"products":78},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[79,84,92],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":80,"product_name":81,"url":82,"description":83},"defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"slug":101,"name":102,"problem":103,"products":104},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[105,113,121],{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",[130],{"slug":131,"name":21,"logo_path":132,"roles":133},"netskope","\u002Fvendor-logos\u002Fnetskope.png",[134],"reported_by",{"slug":136,"title":137,"body":138,"framework_refs":139,"framework_notes":151},"xworm-rat-evolves-into-full-surveillance-platform-via-leaked-source-code","XWorm RAT Evolves Into Full Surveillance Platform via Leaked Source Code","The XWorm Remote Access Trojan has grown far beyond its original capabilities after its builder and source code were publicly leaked, enabling threat actors of varying skill levels to deploy advanced variants with minimal effort. New plugins now allow attackers to perform real-time location tracking, stream live audio, and hijack authenticated browser sessions — representing a severe escalation in privacy and credential risk. The leak of source code dramatically lowers the barrier to entry for cybercriminals, accelerating the proliferation of new, customized variants. This matters because organizations and individuals may be unknowingly surveilled, with sensitive credentials and location data exfiltrated without obvious indicators. Early detection through behavioral monitoring is critical, as signature-based tools may fail to catch novel variants derived from the leaked code.",[140,141,142,143,144,145,146,147,148,149,150],"CIS Control 4 – Secure Configuration of Enterprise Assets","CIS Control 7 – Continuous Vulnerability Management","CIS Control 10 – Malware Defenses","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-53 SI-3 – Malicious Code Protection","NIST SP 800-53 AU-6 – Audit Record Review, Analysis, and Reporting","NIST SP 800-53 AC-6 – Least Privilege","NIST SP 800-53 SC-7 – Boundary Protection","GDPR Article 32 – Security of Processing","MITRE ATT&CK T1219 – Remote Access Software","MITRE ATT&CK T1555 – Credentials from Password Stores",{}]