Talk to an expert
PricingNewsTalk to an expert
Back to Newsroom
Threat Intel

XWorm RAT Now Hijacks Logged-In Browsers and Listens Through Your Microphone

New XWorm builds can drive a victim's already-authenticated browser, stream microphone audio and grab location without a prompt. Detections are up 4x year on year, and finance makes up a third of affected customers.

4T4Tify Team4Tify
Oct 13, 2026·6 min read
XWorm RAT Now Hijacks Logged-In Browsers and Listens Through Your Microphone

XWorm grows into a full surveillance toolkit: live browser takeover, microphone and location

XWorm, a Windows remote-access trojan that has been sold and leaked for years, is no longer mainly a password stealer. Netskope Threat Labs' latest analysis shows its plugin set now lets operators drive a victim's already-logged-in browser, record audio from the microphone, take webcam captures and pull the device's location. Together these turn one infected PC into both a surveillance tool and a way into the user's online accounts.

What happened

Since their July 2025 report, Netskope researchers have tracked four more XWorm builds in the wild: v6.4, v6.5 ("XWorm Reborn"), v7.2 and v7.4. The number of confirmed plugins went from 35 to 46.

Detections are rising too. Netskope recorded 1,236 detection events across more than 100 customer organisations in Q3 2026, about four times the Q3 2025 figure. These are detection events, not a confirmed count of infected machines. Financial services made up roughly 35% of affected customers, and activity clustered in India, Brazil, Italy, Panama and the United States.

The researchers link the jump to leaks. A cracked builder appeared publicly in June 2025, and modified v6.4 source code followed in August. Since then, detection volumes have stayed above earlier levels.

The capabilities that matter

  • HBrowser: remote control of a live browser (since v6). The operator picks a browser in the control panel and sends an OpenBrowser command. The infected machine streams screenshots back and accepts mouse, keyboard, scroll and clipboard input, all over XWorm's AES-encrypted C2 channel. The attacker works inside sessions the victim has already authenticated, so they don't have to log in from a new device.
  • Microphone capture. The plugin lists recording devices (MICCM) and then streams 8 kHz, 16-bit mono audio in 500 ms chunks. Each chunk is compressed and encrypted, and latency is about half a second. CLOSEMIC / ENDMIC stop the capture.
  • Webcam on demand, which puts conversations and activity around the device at risk, not just files.
  • Location. The Maps plugin flips the Windows location-consent registry value to Allow and then asks for coordinates. Netskope saw this happen without privilege escalation or a visible prompt. If GPS isn't available, it falls back to IP-based geolocation, which is far less precise.
  • Evasion keeps improving. v7.2 added native-code hiding and six anti-VM checks. v7.4 uses an XBinder dropper, NTdll unhooking and LocaltoNet-based C2 tunnelling. New plugins include Rootkit, SteamTokenRecovery, HRDP, Cmstp-Bypass and ResetSurvival.

Why it matters

Session hijacking makes stolen passwords unnecessary. When an attacker drives the victim's own browser, the account sees the user's real device, IP and session cookie. That can get them into accounts without triggering a new MFA challenge.

To be precise: this is not evidence that XWorm breaks MFA. It sidesteps a fresh login by riding an existing session. Controls that re-check the user before sensitive actions still apply.

A password reset alone won't evict an attacker who controls the endpoint. If accounts are being misused, treat it as endpoint compromise first. With financial services making up about a third of affected customers, fraud teams and SOCs should look at device signals together with account activity.

What to do

  1. Investigate the device, not just the account. When you see suspicious activity in a session, isolate and triage the endpoint before you reset credentials. Otherwise the attacker keeps access.
  2. Hunt for the behaviours. Look for writes to HKCU\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\location\Value by unexpected processes. Also check for processes opening audio-capture devices without a reason, and for outbound traffic to tunnelling services such as LocaltoNet.
  3. Require step-up authentication for sensitive actions. Payments, payee changes, MFA or recovery changes and data exports should need fresh, phishing-resistant verification (FIDO2/passkeys), not only a valid session.
  4. Shorten and bind sessions. Use short session lifetimes for high-value apps, re-authenticate on risk signals, and use token or device binding where your identity provider supports it.
  5. Lock down privacy permissions centrally. Manage microphone, camera and location access through Group Policy or Intune instead of leaving it to per-user consent, and alert when these settings change.
  6. Block the delivery chain. XWorm usually arrives through scripts and PowerShell, often disguised as receipts or invoices. Restrict script hosts, enable PowerShell logging and AMSI, and apply ASR rules against obfuscated scripts and execution from Office or archives.
  7. Watch for the detection names Gen:Variant.Application.Lazy and Trojan.Generic in your EDR/AV telemetry. They are generic labels, so use them as a lead and not as proof.

Netskope did not publish campaign file hashes. The branding domains seen in v6.4/v6.5 metadata (celestialproject[.]org, c3lestial[.]fun) are not identified as C2, and the ip-api[.]com lookup the malware uses is a legitimate service. Do not blocklist these as malicious infrastructure. Hunt on behaviour instead.

Not sure whether your endpoints and identity controls would catch session hijacking? 4Tify can assess your exposure and help you close the gaps.

Source: this article is based on reporting by Cyber Security News on research from Netskope Threat Labs.

SHARE