How a leaked builder of XWorm turned a remote access trojan into a surveillance kit

Reported by Security Affairs (Pierluigi Paganini)

Summary by Cyber Security News14 Oct 2026, 07:46 CEST

About this summary. This is a short, independently written summary of an article first published by Security Affairs. Cyber Security News did not report or verify the underlying story. Read the original: https://securityaffairs.com/200910/malware/how-a-leaked-builder-of-xworm-turned-a-remote-access-trojan-into-a-surveillance-kit.html

Netskope tracks four XWorm versions in the wild, 46 plugins, and new tools for location, audio and live browser control, with detections up fourfold. Netskope Threat Labs has been following XWorm since September 2024, and its latest report shows the malware has changed a lot. Over the past year the team identified four distinct versions running at the same time in the wild.

Read the full article at Security Affairs →