XWorm Malware Plugins Survive Windows Factory Resets
XWorm has crossed a critical threshold where a conventional Remote Access Trojan (RAT) begins operating like a comprehensive pocket surveillance suite. Recently, Netskope Threat Labs identified four distinct variants of the malware circulating actively alongside 46 specialized modules. Consequently, the updated threat arsenal now features covert audio recording, geolocation tracking, browser session hijacking, and a mechanism to survive complete Windows system resets.
Surviving Factory Resets via System Recovery
The most alarming addition to this modular ecosystem bears the name ResetSurvival. Previously, Trellix researchers analyzed the plugin mechanics in detail. Specifically, once XWorm secures elevated administrative privileges, it deposits its core payload into the C:\Recovery\OEM directory and generates a custom ResetConfig.xml file. Therefore, Windows automatically executes a pre-configured batch script immediately following a standard or factory system reset. Afterward, the malware re-establishes its startup registry keys and resumes operations seamlessly.
Expanded Audio, Location, and Browser Espionage
Furthermore, the malware’s covert surveillance capabilities have expanded dramatically. For instance, the Microphone module streams live audio from a designated recording device by slicing the feed into 500-millisecond fragments. Meanwhile, the Maps plugin modifies Windows location consent parameters directly within the system registry. As a result, it harvests physical coordinates without triggering visible user prompts, defaulting to IP-based geolocation whenever GPS hardware is absent. Operators can also activate the victim’s webcam remotely on demand without deploying a separate utility.
Bypassing MFA with Hidden Browser Sessions
Additionally, a dedicated module named HBrowser transforms the victim’s active web browser into a remote workspace. Through this tool, the threat actor views a continuous stream of screenshots, manipulates the cursor, inputs keystrokes, and interacts directly with authenticated browser tabs. Because the attacker does not need to exfiltrate raw passwords, multi-factor authentication fails to block access to already established sessions. Thus, the operator can hijack sensitive accounts without triggering re-authentication prompts.
Leaked Source Code Fuels Global Proliferation
Notably, this rapid expansion of capabilities coincided directly with a major toolkit leak. In June 2025, a cracked XWorm builder surfaced publicly, followed in August by the modified source code for version 6.4. Immediately following these disclosures, malicious activity surged worldwide. During the third quarter of 2026 alone, Netskope recorded 1,236 distinct infection events across more than 100 organizations, representing a fourfold increase year-over-year.
Evolution from Version 6.0 to 7.4
Following their initial analysis of version 6.0, security specialists tracked the emergence of variants 6.4, 6.5 (dubbed “XWorm Reborn”), 7.2, and 7.4. Specifically, build 6.5 introduced ResetSurvival, Rootkit, SteamTokenRecovery, HRDP, and Cmstp-Bypass modules. Later iterations incorporated advanced code obfuscation, virtual machine evasion checks, and novel command-and-control (C2) communication protocols. Moreover, analysts have already observed XWorm V7.4 deployed in multi-stage attack chains where a custom loader conceals the payload and disables native Windows defenses.
Ultimately, the leaked builder and source code provided disparate threat actors with a unified, extensible platform. In the first quarter of 2026, detection volumes reached seven times the baseline rate and remained elevated throughout the second quarter. Roughly 35% of impacted Netskope clients operate within the financial sector, with concentrated infection waves hitting India, Brazil, Italy, Panama, and the United States.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
