XWorm malware expands surveillance capabilities following source code leaks

The XWorm malware has evolved into a sophisticated digital surveillance platform, significantly increasing its detection rates. According to Netskope Threat Labs, detection events reached 1,236 in the third quarter of 2026, a fourfold increase compared to the same period in 2025.

The surge in activity is attributed to the public leaking of the XWorm builder and source code in mid-2025. This has led to the circulation of multiple versions, including V6.4, V6.5, V7.2, and V7.4, supported by an expanding library of 46 plugins.

Key capabilities of the malware include: • Audio and visual spying: Capturing microphone audio and webcam images. • Location tracking: Obtaining GPS coordinates and IP-based locations by altering Windows settings. • Remote browser control: Interacting with active browser sessions, including clicking, typing, and managing connected accounts.

Impact is concentrated in the financial services sector, which accounts for approximately 35% of affected customers. Geographically, activity is most prevalent in Brazil, India, Italy, Panama, and the United States.