Short answer: XWorm can contain password, token, keylogging, clipboard-monitoring, file-access and remote-control capabilities, but finding XWorm does not prove that a particular password, browser cookie or file was copied. Disconnect the suspected Windows device, use a separate clean device to secure accounts, then scan and investigate persistence. A clean scan cannot prove that earlier theft did not occur.
What XWorm can do—and what a detection does not prove
XWorm is a family of remote-access malware, not one unchanging program. Its operators can use different builds and modules. Malwarebytes describes Backdoor.XWorm as capable of silent operation, spying, keylogging, data theft and interference with security settings. Microsoft’s Trojan:MSIL/XWormRAT!MTB description, updated January 25, 2026, documents browser-credential and Discord-token stealing, keylogging, clipboard monitoring and remote-access behavior.
As an Amazon Associate I earn from qualifying purchases.
Those are documented capabilities of particular detections. They are not a receipt showing what happened on your computer. The same family can be configured differently, and a component may be present without being run successfully. Microsoft’s public pages provide behavior descriptions, sample indicators and response advice; they do not provide a consumer test that identifies every credential, cookie or file copied before discovery.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesHow to interpret the word “cookies”
The Microsoft MSIL description explicitly names browser credentials and Discord tokens. It does not establish that every XWorm variant steals every browser cookie. Other threat descriptions may mention cookie theft, but that cannot be generalized to all XWorm infections. Treat active browser sessions and account tokens as potentially exposed when the device was compromised, while keeping the distinction between possible capability and proven exfiltration.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What “stealing files” could mean
Remote-access malware may be able to browse directories, read documents, take screenshots or transfer selected files, but a capability description does not identify which folders an operator viewed. A detection also does not tell you whether an operator ever connected. List the sensitive material that was accessible from the computer—tax records, password exports, work documents, source code, photographs and saved browser data—so you can prioritize account changes and notify the right people. Do not open suspicious files merely to see what they contain.
Do this first: contain the suspected computer
Do not investigate by continuing to use the possibly infected Windows installation for email, banking or password changes. Isolation limits an operator’s access and reduces the chance of additional transfers.
- Disconnect every network path. Turn off Wi-Fi, unplug Ethernet and disconnect Bluetooth. Microsoft Security Intelligence’s MSIL guidance says: “Immediately disconnect the infected device from all networks, including Ethernet, Wi-Fi, and Bluetooth.” The instruction appears in its Trojan:MSIL/XWormRAT!MTB threat description.
- Stop signing in on that device. Do not enter a new password, approve a multifactor prompt or open sensitive files there while you are containing it.
- Move account recovery to a known-clean device. Use a separate computer or phone that is updated and not showing signs of compromise. Microsoft specifically recommends changing passwords for accounts used on the infected system from a clean device.
- Tell your organization promptly if it is a work or school computer. Disconnect it as instructed by your IT or security team, but do not wipe it before they decide whether evidence is needed.
- Record the basics. Note when the alert appeared, what you were doing, the detection name, and any unusual account notifications. Screenshots and the exact alert text can help an incident responder.
If you cannot disconnect a managed computer yourself, unplug its network cable or disable Wi-Fi only if your organization’s procedure allows it, then call IT. Do not connect an external drive, phone or backup disk to copy files until an expert says it is safe; removable media can spread malware or overwrite useful evidence.
Can you tell whether XWorm already sent your data?
Usually, a home user cannot establish that from a local scan alone. A scan reports what the security product finds at that time; it does not reconstruct every earlier file read, keystroke, clipboard capture or network transfer. XWorm traffic can stop, use changing infrastructure or be encrypted, and local logs may be incomplete or overwritten.
Therefore, use a negative result to guide cleanup—not as proof that no password, cookie, token or file was taken. If the computer handled business records, privileged credentials, financial information or regulated data, preserve available evidence and ask a qualified incident-response professional to examine endpoint and network records. Microsoft’s public XWorm pages do not offer a consumer procedure that proves a past transfer did or did not happen.
| Observation | What it can tell you | What it cannot establish |
|---|---|---|
| Defender detects and removes XWorm | Active malware or a known remnant was found and a remediation action was attempted. | That no data was copied before detection, or that every persistence change was reversed. |
| No detection in a current full scan | The tool did not find the malware or remnants it recognizes during that scan. | That the system was never infected or that historical exfiltration did not occur. |
| An unfamiliar scheduled task, startup item or Run entry | There may be persistence or an unrelated application that needs identification. | That the entry is XWorm solely because its name looks suspicious. |
| A suspicious domain, IP address or port in a report | It may match an analyzed sample or a temporary indicator. | Universal attribution; indicators are variant- and sample-specific and can become stale. |
Run the safest Windows checks
1. Review Microsoft Defender’s history and update it
- On a clean connection, open Windows Security.
- Select Virus & threat protection, then Protection history. Expand the alert and record its detection name, date and action.
- Return to Virus & threat protection, choose Protection updates and select Check for updates.
- Choose Scan options and run a Full scan. Let it finish; do not treat an absence of alerts as proof of no past theft.
Microsoft notes that Defender may automatically remove a detection while remnants or system changes remain. Its VBS/XWormRAT!rfn guidance and MSIL guidance both recommend current definitions and a full scan.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
2. Check whether security settings were weakened
Open Windows Security > Virus & threat protection > Manage settings. Look for exclusions, disabled real-time or cloud protection, or Tamper Protection changes that you did not make. Restore settings only if you understand the effect and your organization does not manage them. XWorm analyses from Microsoft describe attempts to alter Defender settings, but an altered setting is not by itself proof of XWorm; legitimate administration tools and software installers can also change security controls.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →3. Review scheduled tasks without deleting blindly
- Search Windows for Task Scheduler and open Task Scheduler Library.
- Sort or inspect tasks created around the time of the alert. Check the author, trigger, action and program path.
- Investigate entries that launch scripts or executables from unusual user, temporary or public folders, or that run at logon without a clear owner.
Do not delete a task merely because its name is unfamiliar. Export or photograph its properties and ask IT or a qualified technician if you cannot identify it. Microsoft’s VBS variant analysis and other XWorm descriptions document scheduled-task persistence, but names and paths from analyzed samples are not universal signatures.
4. Inspect startup apps and Run keys
Check Settings > Apps > Startup and the Startup tab in Task Manager for programs you did not install. For advanced review, security professionals commonly inspect the per-user and machine-wide Run locations:
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRunHKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun
Registry editing can disable legitimate software or Windows components. Export a key before changing it, and obtain expert help when the publisher, path or purpose is unclear. Microsoft’s Win32/XWormRAT!AMTB description, updated October 29, 2025, and its other variant pages describe startup and Run-key persistence in analyzed samples.
5. Look for suspicious files and processes
Note newly created executables, scripts, archives and hidden files in user-profile, public or temporary directories, especially if they appeared with a suspicious attachment or cracked software. In Task Manager, check processes with unusual names, paths, publishers or sustained CPU, disk or network use. A name alone is weak evidence: malware can imitate a legitimate filename, and legitimate software can have an unfamiliar helper process. Preserve the path and digital-signature information rather than opening the file.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match6. Observe network behavior carefully
With the device isolated, you can document which programs were using the network before shutdown if that information is still available in Task Manager or Resource Monitor. After cleanup, review firewall, DNS, VPN or endpoint logs if you have them. Microsoft’s variant pages include sample domains, IP addresses and ports, but those indicators are tied to particular samples, may change, and should not be treated as a complete blocklist. A match deserves investigation; no match does not clear the computer.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
7. Do not install an untrusted “XWorm remover”
A search advertisement, forum attachment or unsolicited message promising a special removal utility can be another malware delivery route. Use built-in Windows security features, reputable security software obtained from its official source, and current vendor instructions. If the alert returns after remediation, stop experimenting and escalate.
Secure passwords, sessions and tokens from a clean device
Assume that accounts used on the suspected computer could be exposed, even when you cannot prove a theft event. Start with accounts that can reset or reach other accounts.
- Secure the primary email account. Change its password, check recovery addresses and phone numbers, remove unfamiliar forwarding rules, and review recent sign-ins.
- Protect financial and payment accounts. Change credentials through the official app or site and contact the institution if you see unauthorized activity.
- Rotate work, school, administrator and password-manager credentials. Tell the organization which device was involved so it can reset tokens, disable sessions or investigate related systems.
- Revoke active sessions. Use each service’s “sign out of all devices,” session-management or token-revocation control where available. This is especially important for browser sessions and chat or development tokens.
- Turn on multifactor authentication. Prefer an authenticator app or a FIDO2 security key when the service supports it. MFA helps stop reuse of a stolen password; it does not detect or remove malware.
- Review account activity. Look for unfamiliar logins, password-reset messages, new devices, sent mail, file-sharing events and changed recovery details. Save evidence before deleting notifications.
Change reused passwords everywhere they appeared. Do not copy a new password from the potentially infected computer or store it in a browser profile that you have not secured. If a service offers separate controls for signing out browser sessions, revoking application tokens and removing trusted devices, use all of them; changing a password does not always invalidate every existing token.
Choose a response based on urgency, ownership and confidence
| Situation | Priority | Recommended path |
|---|---|---|
| Active alert, pop-ups, unknown remote control or continuing network activity | Immediate containment | Disconnect all networks, stop using the device for accounts, and contact IT or an incident responder. |
| Personal computer; Defender removed a single detection and no sensitive work data was present | Account protection plus verification | Change passwords from a clean device, enable MFA, update definitions, run a full scan and review persistence. |
| Work, school or shared computer; administrator access or business data was present | Organizational incident response | Keep it isolated, preserve the alert and timeline, and let IT/security decide on imaging, evidence collection and rebuild. |
| Confirmed compromise or unexplained changes remain after scanning | High confidence required | Back up only known-safe personal data, preserve evidence when needed, and consider a full operating-system rebuild from trusted installation media. |
When a rebuild is safer than continued cleanup
A clean reinstall is a general incident-response option when XWorm is confirmed, persistence cannot be explained, security settings keep changing, or system integrity is uncertain. Use trusted installation media and fully update Windows before restoring applications. Do not restore unknown executables, scripts or browser profiles wholesale.
For a business or managed device, consult IT before wiping it. A rebuild can remove evidence needed to determine scope, and the organization may need to reset additional credentials, inspect neighboring systems or meet reporting obligations. Account password changes and MFA should still happen from a clean device while that decision is made.
How Microsoft’s documented variants differ
The following dates and behaviors describe Microsoft’s named detections, not a complete catalog of XWorm builds.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
| Detection page | Publication and update | Documented behaviors relevant to this check |
|---|---|---|
| Trojan:MSIL/XWormRAT!MTB | Published February 14, 2024; updated January 25, 2026 | Browser-credential and Discord-token theft, keylogging, clipboard monitoring, remote access, persistence, security impairment and network-disconnection/password-change response advice. |
| Trojan:VBS/XWormRAT!rfn | Published May 20, 2025; updated October 26, 2025 | VBS-based sample indicators, scheduled-task and file/registry persistence, Defender changes and full-scan guidance. |
| Trojan:Win32/XWormRAT!AMTB | Published May 20, 2025; updated October 29, 2025 | Win32 sample details including hidden files, persistence and Defender tampering. |
| Malwarebytes Backdoor.XWorm threat alert | No original publication date was shown on the cited page | Family-level description of silent operation, spying, keylogging, data theft and possible interference with security settings. |
Because XWorm changes and operators select capabilities, a checklist based on one page cannot cover every build. Recheck current vendor guidance when a new detection name appears, and treat sample filenames, task labels, paths, domains and ports as clues for investigation rather than universal signatures.
Recommended Free Tools
Common mistakes that make the situation worse
- Changing passwords before isolation. If the malware is still active, the new password can be captured too.
- Assuming a browser-cookie reset is enough. Secure the account itself, revoke sessions and tokens, and review recovery settings.
- Deleting every unfamiliar task or file. This can damage Windows, destroy evidence or remove a legitimate business tool.
- Using sample indicators as a verdict. An IP, port, filename or task label from a vendor report is not a universal signature for every build.
- Restoring an entire old profile after a rebuild. Unknown scripts, extensions and executables can reintroduce the problem.
- Ignoring phones and other accounts. Prioritize any service that was signed into from the affected PC, especially email and financial services.
Signs that account recovery should continue even after cleanup
- Unexpected password-reset messages, MFA prompts or new-device notifications.
- Unknown sessions, forwarding rules, recovery addresses or connected applications.
- Messages, payments, file shares or profile changes you did not make.
- The same detection returning after restart, or Defender settings changing again.
- Unexplained scheduled tasks, startup entries, scripts or network connections that remain after remediation.
These signs do not identify XWorm by themselves. They indicate that the account or device deserves further investigation and that password rotation, session revocation and organizational notification should not be postponed.
Frequently Asked Questions
Is XWorm definitely stealing my passwords if Defender detects it?
No. XWorm variants can include credential-stealing modules, but a detection proves that a security product found a related threat or remnant—not that a specific password was copied or sent. Treat accounts used on the computer as potentially exposed and change them from a clean device.
Can a scan tell me whether my browser cookies were stolen?
Usually not. A scan can find active malware or remnants; it cannot reconstruct every earlier read or transfer. Microsoft explicitly documents browser credentials and Discord tokens for one MSIL detection, but does not establish cookie theft for every XWorm variant.
Should I change passwords on the infected PC?
No. Disconnect it and use a separate, known-clean device. Start with email, banking, work, administrator and password-manager accounts, then revoke sessions and enable MFA.
Free tools Windows power users keep installed
One-click scans. No signup required.
What should I do with a work or school computer?
Disconnect it as instructed by your organization and contact IT or security promptly. Do not wipe, reinstall or delete suspicious files before they decide whether evidence and a wider investigation are needed.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Does Microsoft Defender automatically remove XWorm completely?
It may automatically remove a detected component, but Microsoft warns that remnants or system changes can remain. Update definitions, run a full scan and check persistence and security settings. A clean result does not prove past theft did not occur.
Should I delete an unfamiliar scheduled task or Run-key entry?
Not solely because the name looks suspicious. Record its author, trigger, command and path, and get qualified help if you cannot identify it. XWorm samples use persistence, but legitimate software does too.
When should I reinstall Windows?
Consider a trusted reinstall when compromise is confirmed, persistence or security changes continue, or system integrity cannot be trusted. Preserve evidence and consult IT first for a managed device; back up only known-safe personal data.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Can a FIDO2 security key remove XWorm or prove my files were safe?
No. A FIDO2 key is an MFA method that can help prevent reuse of a stolen password. It does not detect, remove or investigate malware, and it cannot establish whether files or tokens were previously copied.
The Bottom Line
Bottom line: XWorm can be capable of stealing credentials, tokens and other data, but no consumer scan can reliably show exactly what was taken. Isolate the computer, secure accounts from a clean device, preserve evidence when the stakes are high, and involve IT or qualified incident responders for managed or confirmed compromises.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
