XWorm HBrowser Plugin Lets Attackers Control Authenticated Browser Sessions Without Credentials

What happened

Researchers recorded 1,236 XWorm detection events across more than 100 customer organizations during Q3 2026, four times the volume observed in Q3 2025. XWorm’s HBrowser plugin gives attackers interactive control of authenticated browser sessions on infected endpoints, allowing them to operate accounts without stealing passwords or completing another multifactor authentication challenge.

Financial services represented approximately […] The post XWorm HBrowser Plugin Lets Attackers Control Authenticated Browser Sessions Without Credentials appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform . cyber security Cyber Security News 2 min.

Financial services represented approximately 35% of affected customers, with activity concentrated in India, Brazil, Italy, Panama, and the United States. These figures describe Netskope’s customer telemetry, not a global infection count.

Available since version 6, HBrowser lets an operator select a target browser through the XWorm control panel. The panel sends an OpenBrowser command containing the browser identifier and display dimensions through the malware (software written to damage a system or steal from it)’s command-and-control channel.

The infected endpoint executes subsequent inputs while continuously returning screenshots, creating an interactive remote browsing session. Supported commands relay keyboard characters, mouse clicks, cursor movement, scrolling, and pasted clipboard text.