Free tools Windows power users keep installed
One-click scans. No signup required.
XWorm has grown beyond remote access and basic information theft in some analyzed versions: Netskope reported variants with plugins for location access, live microphone audio, on-demand webcam capture, and interaction with authenticated browser sessions. These features are not present in every XWorm infection, and “surveillance platform” is a description of the capabilities Netskope observed—not an official malware classification.
What XWorm is—and what changed
XWorm is a Windows remote access trojan (RAT): malware that can let an operator control an infected device remotely. Its capabilities vary by version and installed plugins. Microsoft’s description of a Win32 variant includes command execution, keylogging, screen capture, distributed denial-of-service (DDoS) activity, persistence, command-and-control (C2) communication, and downloading additional payloads. Splunk describes related behaviors such as remote desktop control, clipboard monitoring, file theft, and persistence. Neither account should be read as a definitive feature list for every build.
As an Amazon Associate I earn from qualifying purchases.
Netskope Threat Labs’ October 2026 report identifies V6.4, V6.5 “XWorm Reborn,” V7.2, and V7.4 among versions seen since its July 2025 V6.0 report. Its analysis describes changes including new or restored plugins, KeyAuth licensing in V6.5 and V7.4, native-code obfuscation and anti-virtual-machine techniques in V7.2, and changes to the V7.4 dropper and C2. These are observations about analyzed builds, not proof that all versions share every feature. Netskope’s October 2026 analysis
What the new surveillance plugins do
Maps: location access
Netskope says the Maps plugin changes a Windows location-consent registry value before requesting location, which can avoid the user prompt in the implementation it analyzed. If GPS location is unavailable, it can fall back to IP-based geolocation. Netskope reported this behavior without privilege escalation or a visible prompt in its analysis; that finding is specific to the analyzed implementation, not a guarantee about every infection.
#1 Best Overall
Microphone and webcam: audio and images
The Microphone plugin captures nearby audio and streams it through the C2 channel. Netskope reported that it operated without privilege escalation or a visible prompt in the version it examined. As the report puts it, “The Maps plugin locates the victim, while the Microphone plugin records audio near the victim’s device.” Webcam capture is also reported, but as an on-demand capability; the report does not establish that every infection continuously records video.
HBrowser: access to an active browser session
HBrowser gives an operator a live view of the victim’s browser, passes keyboard and mouse input to the active browser, and returns screenshots. That may expose information inside a session that is already authenticated. In the scenario Netskope describes, the operator can use the existing session without first stealing the password or prompting a new login, so multifactor authentication does not protect that already-authenticated session from control of the infected device. This is not the same as bypassing MFA for every account or login.
Netskope’s plugin analysis explains the reported browser and surveillance behavior.
Recommended Free Tools
How widespread is the activity?
Netskope’s figures describe its own telemetry, not a count of all XWorm infections. In Q3 2026, Netskope Threat Labs recorded 1,236 events across more than 100 customer organizations, four times its Q3 2025 figure. About 35% of affected customers in that dataset were in financial services. Netskope said activity was concentrated in India, Brazil, Italy, Panama, and the United States; these are observations from its customer data, not a global ranking.
Netskope also reported that the number of confirmed plugins it had identified rose from 35 in July 2025 to 46 in October 2026. Its activity tracking says detections increased more than fourfold from Q3 to Q4 2025, reached seven times the original baseline in Q1 2026, and remained at that level through Q2 2026. The report attributes the initial surge to the public release of the V6.4 builder in mid-2025. These counts and trends are specific to Netskope’s reporting and should not be treated as a universal inventory or infection rate. Netskope’s report and telemetry scope
How to detect suspicious activity
No single symptom proves that a device is infected with XWorm. Investigate combinations of unusual endpoint and network behavior, especially when an activity is unexpected for the user or device.
- Persistence changes: unexpected startup entries or registry changes can indicate that malware is trying to survive a restart.
- Suspicious processes and scripts: investigate unusual PowerShell activity, unexpected process behavior, or suspicious image loads in context.
- Security-tool changes: unexpected Defender exclusions or other attempts to weaken protection warrant investigation.
- Unusual outbound traffic: unexpected connections or network-flow anomalies may indicate C2 communication or data transfer.
- Unexpected surveillance or control: unexplained access to the microphone, webcam, location settings, browser, clipboard, or files can strengthen concern when it coincides with other indicators.
Splunk’s published detection story draws on endpoint events and network flows, including Sysmon process and image-load events, Windows event logs, endpoint process telemetry, and network-flow data. Microsoft’s variant description provides another view of XWorm behavior; the vendors describe different samples and telemetry, not one universal signature. Splunk’s XWorm detection story and Microsoft’s Win32 variant description
What to do if you suspect an infection
- Isolate the affected device. Disconnect Ethernet or turn off Wi-Fi to interrupt C2 communication and possible data exfiltration. Microsoft’s guidance is: “Unplug the ethernet cable or deactivate Wi-Fi to prevent the malware from communicating with its C2 servers and exfiltrating your data.” If this is a work device, contact your organization’s security or IT team and follow its incident-response process.
- Use a different trusted device for sensitive accounts. After the affected device has been cleaned, change sensitive passwords from a separate trusted device. If a browser session may have been exposed, use the account provider’s security controls to review sessions and revoke ones you do not recognize.
- Check for known artifacts and remove them as part of cleanup. Microsoft recommends checking and removing known artifacts. In an organization, preserve and investigate evidence according to the incident-response process rather than treating a quick deletion as a complete forensic investigation.
- Run a full antimalware scan. Update the antimalware definitions first, then run a full scan. Follow your security team’s recovery guidance if the scan finds malware or the device continues to behave unusually.
These steps reflect Microsoft’s published guidance; they are not a substitute for a full organizational investigation or recovery plan. Microsoft’s XWorm guidance
Best Value
Why the surveillance shift matters
The added plugins broaden the risk from controlling a computer or stealing files to observing a person’s surroundings and using the sessions and devices they already have open. In particular, HBrowser means that a password-only response may be insufficient if an active session was exposed: defenders may also need to revoke sessions and review account activity. For individuals, unexpected device behavior deserves attention; for organizations, endpoint signals and network behavior are more useful when investigated together through an established incident-response process.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
