- Netskope Threat Labs reports that XWorm, a Windows remote-access trojan, now has 46 plugins, including silent location tracking, live microphone streaming and control of logged-in browsers.
- Because the operator uses the victim's open session, multi-factor authentication is never challenged. Netskope says this makes MFA irrelevant for those accounts.
- Leaders should ask whether their controls watch the endpoint and the session, not only the login, and how fast a hijacked session can be ended.
Multi-factor authentication checks who walks through the door. It says little about someone who is already sitting in the room. That gap is the idea behind recent versions of XWorm, a remote-access trojan (RAT) that Netskope Threat Labs says has grown from an infostealer into a surveillance platform.
What Netskope found
Netskope's researchers recorded 1,236 XWorm events across more than 100 of its customer organizations in the third quarter of 2026. That is four times the level of the same quarter in 2025. The figures come from Netskope's own customer telemetry, so they are not a count of all infections.
The surge followed leaks. A cracked builder, the tool used to assemble the malware, went public in June 2025. Source code for version 6.4 leaked in August. Netskope says activity reached seven times the original baseline in the first quarter of 2026 and held there through the second quarter.
Third-quarter volume dipped from that peak. But September alone brought 601 of the 1,236 events, matching the monthly average of the Q1 and Q2 peak. Netskope identified four versions running at the same time: V6.4, V6.5 "XWorm Reborn", V7.2 and V7.4.
How the plugins work
Three plugins matter most here. Each is simple in design, which is part of the lesson. One of them is not new. HBrowser has been in XWorm since version 6, which Netskope covered in July 2025. Netskope's latest report ties it to the newer surveillance plugins. Maps and Microphone come from the new version samples.
HBrowser lets the attacker watch and steer the victim's open browser from afar. The operator picks a browser from a control panel, and the panel sends an OpenBrowser command. From then on, each action the operator takes is sent to the victim's machine and replayed in the real browser. Screenshots stream back. Netskope describes it as a full remote browser session in which every authenticated tab is accessible.
Maps finds the victim's location. Windows normally asks the user for consent. The plugin writes "Allow" to the CapabilityAccessManager registry key first, so the request passes with no prompt. It then asks for a GPS fix, waiting up to 15 seconds. If the machine has no GPS, it falls back to IP-based location. The consent setting stays in place, so later requests skip the check.
Microphone records audio near the device. It captures sound in half-second chunks, compresses and encodes each one, and encrypts the stream before sending. The operator hears it about half a second late and can stop it at any time. Netskope reports that neither Maps nor Microphone needs higher system rights, and the user sees no warning. Webcam capture is also available on demand.
The real shift: the session is the target
Most security programs treat the login as the moment of truth. Passwords are guarded, and MFA is added to protect them. HBrowser skips that moment. The operator never needs the password, because the victim already logged in. Netskope says the plugin works "without touching credentials", which makes MFA irrelevant for those accounts.
This shows where the risk has moved. An employee's logged-in browser holds access to email, finance tools and cloud consoles. Whoever controls that browser can reach whatever the session is already allowed to reach. The same malware can also tell the attacker where the employee is and what is being said nearby.
Detections cluster in five countries: India, Brazil, Italy, Panama and the United States. Financial services makes up about 35% of the affected customers. Both figures describe Netskope's customer base, not every organization.
What leaders should ask
The source does not describe how XWorm reaches each victim, so the questions below focus on what happens after infection.
First, can your team see an unusual change to Windows privacy settings, such as a location-consent registry value being set to Allow? Second, if a laptop is compromised, how quickly can you end every active session for that user, not only reset the password? Third, do your most sensitive roles, such as finance and administrators, work on devices with tighter monitoring than the rest of the company?
Fourth, do your MFA metrics measure sign-ins only? If so, they say nothing about what happens inside a session that was already approved. Netskope's own outlook is that it expects continued upgrades to this toolkit, now that its builder and source code are public.
Locking the door still matters. But the attacker in this report is already inside the room, using the victim's own chair.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Netskope Threat Labs.
