XWorm RAT Evolves Into Surveillance Platform

What happened

Expanded plugin count allows the malware (software written to damage a system or steal from it) to monitor users’ location, stream live audio, and interact with authenticated browser sessions. Malware & Threats XWorm RAT Evolves Into Surveillance Platform Expanded plugin count allows the malware to monitor users’ location, stream live audio, and interact with authenticated browser sessions.

A sophisticated, multi-functional Windows RAT first observed in 2022, XWorm provides attackers with full control over the infected systems, offering keylogging, screenshot capture, webcam access, and payload execution capabilities. Some of these have been clearly designed for surveillance: enabling location tracking, live audio streaming, webcam capture, and interactive control over authenticated browser sessions.

The post XWorm RAT Evolves Into Surveillance Platform appeared first on SecurityWeek . The malware’s developers have been constantly updating its codebase and adding new functionality, and the threat has remained highly active, with Netskope observing over 1,200 incidents across 100 organizations during the third quarter of the year. Alongside new variants, the developers have also increased the number of plugins XWorm supports, from 35 in July 2025 to 46 in October 2026.

Key facts

• A sophisticated, multi-functional Windows RAT first observed in 2022, XWorm — provides: attackers with full control over the infected systems, offering keylogging, screenshot capture, webcam access, and payload execution capabilities