XWorm Malware Spies Via Microphones, Hijacks Browser Sessions

Key Takeaways

• XWorm malware has evolved beyond simple data theft, now incorporating advanced surveillance and browser hijacking capabilities.
• New plugins allow attackers to remotely activate microphones and webcams, track device location, and directly control logged-in browser sessions.
• The browser hijacking feature is particularly dangerous as it bypasses multi-factor authentication by operating within already authenticated user sessions.
• Financial services organizations are heavily targeted, with significant activity observed in India, Brazil, Italy, Panama, and the United States.
• The continued development and proliferation of XWorm are driven by leaked builder tools, leading to a four-fold increase in detections in Q3 2026 compared to Q3 2025.

XWorm malware has significantly expanded its capabilities, transforming from a basic information stealer into a sophisticated surveillance and browser hijacking platform. Attackers can now leverage infected Windows machines to covertly record audio, pinpoint device locations, and take direct control of active browser sessions, even when users are already logged in.

This evolution is attributed to an expanding collection of plugins that allow a compromised device to serve as both a spying tool and an entry point into a victim’s online accounts, circumventing the need for initial password theft. More details on XWorm’s capabilities are available in a comprehensive report from Netskope Threat Labs.

The ability to hijack browser sessions is particularly alarming. Instead of requiring attackers to log in from a separate machine, XWorm directly manipulates the victim’s currently authenticated browser. This grants access to online accounts without triggering additional multi-factor authentication (MFA) challenges, although it’s important to note that XWorm does not inherently defeat all forms of MFA. It simply bypasses new login prompts by operating within an existing, validated session.

Researchers from Netskope Threat Labs identified four active XWorm versions since their initial report in July 2025. Their latest analysis for Q3 2026 documented 1,236 detection events across more than 100 client organizations, representing a four-fold increase over Q3 2025 figures. While these numbers reflect detection events rather than unique infected devices, they indicate a substantial surge in XWorm activity. The financial services sector accounts for roughly 35% of affected organizations, with significant concentrations observed in India, Brazil, Italy, Panama, and the United States. These findings build upon earlier reports detailing XWorm’s use of Windows scripts and PowerShell to install malware and obscure its execution within legitimate Windows processes.

XWorm Malware Can Spy

HBrowser Plugin for Interactive Browser Control

The HBrowser plugin, introduced in XWorm version 6, provides attackers with a live, interactive view of a victim’s active browser. An attacker can select a supported browser from the control panel, initiating an OpenBrowser command via XWorm’s command-and-control (C2) channel. The compromised machine then relays remote input from the attacker and transmits real-time screenshots back to the operator.

All user interactions, including mouse clicks, cursor movements, scrolling, keyboard input, and pasted text, are transmitted through an AES-encrypted channel. This effectively creates a functional remote browser session, distinct from merely stealing browser data. Critically, this allows attackers to operate within authenticated browser tabs, exploiting existing login sessions without needing to re-authenticate or overcome multi-factor challenges. This method differs from techniques like GhostProfile, which focuses on copying browser profiles on macOS, as XWorm actively controls a live, running browser on Windows.

Microphone and Webcam Surveillance

XWorm’s Microphone plugin leverages the NAudio library’s WaveInEvent function to capture audio from the victim’s recording devices. After listing available devices using the MICCM command, the malware records 8 kHz, 16-bit mono audio in 500-millisecond chunks. Each audio buffer is then compressed, encoded, encrypted, and streamed back to the C2 server. Netskope observed an approximate half-second latency in audio transmission, with recording persisting as long as the attacker maintains the session. Commands such as CLOSEMIC and ENDMIC are used to halt recording or terminate the session. The malware also offers on-demand webcam capture, significantly expanding the scope of potential surveillance beyond data theft to include real-time monitoring of conversations and activities around the compromised device.

Location Tracking Capabilities

The Maps plugin in XWorm manipulates a Windows registry value, specifically HKCUSoftwareMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStorelocationValue, setting it to Allow to enable location services. Netskope’s analysis revealed that this occurs without requiring privilege escalation or displaying a visible permission prompt to the user. The malware then attempts to retrieve precise coordinates using GeoCoordinateWatcher.TryStart with a 15-second timeout. If GPS data is unavailable, it falls back to an IP-based location lookup using the legitimate service hxxp://ip-api[.]com/csv/?fields=lat,lon. It is important to distinguish that IP-derived location data is less precise than GPS coordinates.

Leaked Builders Drive Continued Development

The number of confirmed XWorm plugins has grown from 35 to 46 since Netskope’s July 2025 report. Researchers have tracked versions V6.4, V6.5 (“XWorm Reborn”), V7.2, and V7.4, noting new additions such as Rootkit, SteamTokenRecovery, HRDP, Cmstp-Bypass, and ResetSurvival. This ongoing development enhances XWorm’s defense evasion techniques, building on previously observed changes in loaders, script formats, and efforts to weaken Windows monitoring functionalities.

The public availability of a cracked XWorm builder in June 2025, followed by leaked V6.4 source code in August, significantly contributed to the malware’s proliferation. Netskope attributes the sustained high detection volumes throughout 2026 to these leaks. Subsequent versions introduced further sophistication: V7.2 integrated native-code hiding and six anti-virtual-machine checks, while V7.4 adopted an XBinder dropper, NTdll unhooking, and a LocaltoNet-based C2 infrastructure.

What You Should Do

• Implement robust endpoint detection and response (EDR) solutions capable of monitoring for suspicious process behavior, registry modifications, and unusual network traffic.
• Train users to recognize and avoid phishing attempts, particularly those involving fake receipts or other common business documents that could lead to malware infection.
• Enforce strong password policies and enable multi-factor authentication (MFA) across all critical accounts. While XWorm bypasses *new* MFA challenges by hijacking existing sessions, MFA remains crucial for initial login security.
• Regularly audit and monitor logs for unusual browser activity, unauthorized microphone/webcam access, and unexpected location service requests.
• Maintain up-to-date operating systems, browsers, and security software to patch known vulnerabilities that malware like XWorm might exploit.
• Consider implementing application whitelisting to prevent unauthorized executables from running on endpoints.
• Investigate any alerts that combine indications of device compromise with account misuse, as these could signal an XWorm infection leveraging active browser sessions.

Indicators of Compromise (IoCs)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.