XWorm Malware Can Spy Through Your Microphone and Hijack Logged-In Browser Sessions

XWorm malware is moving beyond password theft, giving attackers tools to listen through infected computers, track their location, and control browsers where users are already logged in.

Its growing plugin collection turns a compromised Windows device into both a spying tool and a route into online accounts, without requiring attackers to steal passwords first.

The browser feature is especially concerning because it uses sessions that have already passed login checks. Instead of signing in from another computer, an attacker operates the victim’s browser directly.

This can allow access to authenticated accounts without another multifactor authentication challenge, although it does not mean XWorm can defeat every possible security check.

Researchers from Netskope Threat Labs identified four XWorm versions operating in the wild since their July 2025 report.

In their latest XWorm research report, they recorded 1,236 detection events across more than 100 customer organizations during Q3 2026, four times the volume recorded in Q3 2025.

These figures describe detections, not a confirmed count of unique infected devices. Financial services represented approximately 35% of affected customers, with activity concentrated in India, Brazil, Italy, Panama, and the United States.

The findings extend earlier reporting on XWorm Windows script delivery, which showed how scripts and PowerShell helped install the malware while hiding its execution inside legitimate Windows processes.

XWorm Malware Can Spy

The HBrowser plugin, available since version 6, gives operators an interactive view of a victim’s running browser. An attacker selects a supported browser from the control panel, which sends an OpenBrowser command through XWorm’s command-and-control channel.

The infected computer then accepts remote input and sends screenshots back to the operator. Mouse clicks, cursor movements, scrolling, keyboard input, and pasted text travel through the same AES-encrypted channel.

This creates a working remote browser session rather than a simple collection of stolen browser files. Authenticated tabs become accessible, allowing attackers to use accounts while the victim’s existing login remains active.

The distinction matters: this is not evidence that XWorm breaks MFA itself. It avoids a fresh login by working inside an already authenticated session.

Related reporting on GhostProfile browser session hijacking describes another approach to live account access, but GhostProfile copies browser profiles on macOS, whereas Netskope describes XWorm controlling a running browser on Windows.

XWorm’s Microphone plugin uses the NAudio library’s WaveInEvent function to capture sound from a recording device selected by the attacker.

It first lists available devices through the MICCM command, then records 8 kHz, 16-bit mono audio in 500-millisecond buffers. Each buffer is compressed, encoded, encrypted, and streamed back through the control channel.

Netskope reports roughly half a second of audio latency, with recording continuing while the operator keeps the session open. Commands named CLOSEMIC and ENDMIC stop capture or end the session.

Webcam capture is also available on demand, widening the risk beyond stolen files to conversations and activity around the infected device.

The Maps plugin changes a Windows location-consent registry value to Allow before requesting coordinates. Netskope observed this running without privilege escalation or a visible permission prompt.

It calls GeoCoordinateWatcher.TryStart with a 15-second timeout and falls back to IP-based location lookup when GPS is unavailable. IP-derived location should not be confused with precise GPS coordinates.

Leaked Builders Drive Continued Development

The confirmed plugin count increased from 35 to 46 after Netskope’s July 2025 report. Researchers tracked V6.4, V6.5 “XWorm Reborn,” V7.2, and V7.4, with additions including Rootkit, SteamTokenRecovery, HRDP, Cmstp-Bypass, and ResetSurvival.

This growth builds on XWorm defense evasion techniques, previously reported alongside changing loaders, script formats, and attempts to weaken Windows monitoring.

A cracked builder appeared publicly in June 2025, followed by modified V6.4 source code in August. Netskope linked these releases to higher detection volumes, which remained above earlier levels through 2026.

V7.2 added native-code hiding and six anti-virtual-machine checks, while V7.4 used an XBinder dropper, NTdll unhooking, and LocaltoNet-based control infrastructure.

For defenders, the report highlights the need to investigate device compromise alongside account misuse. Earlier XWorm fake receipt campaigns show how ordinary business documents can lead to infection.

Browser access, microphone capture, registry changes, and remote-control traffic should be examined together rather than treated as unrelated events. A valid account session does not prove that the person using it is legitimate.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post XWorm Malware Can Spy Through Your Microphone and Hijack Logged-In Browser Sessions appeared first on Cyber Security News.