XWorm, a type of malicious software, has turned infected computers into surveillance instruments. This malware is active in Brazil and has the capability to record conversations via the microphone, monitor geographical location, and capture images using the webcam.
Additionally, the program allows criminals to take control of browsing sessions and gain access to accounts that are already logged into the victim's system.
According to Netskope Threat Labs, 1,236 detection incidents were recorded during the third quarter of 2026, representing a fourfold increase compared to the same period in 2025. This survey indicates both the expansion of the malware's functionalities and the persistence of the threat, even after the leakage of tools used for its creation.
Since July 2025, researchers have identified four variants of XWorm in circulation: V6.4, V6.5, V7.2, and V7.4. Concurrently, the number of plugins associated with this tool has increased, rising from 35 to 46.
The various functions identified by Netskope can be executed without the victim noticing. Regarding location tracking, the malware can access coordinates by altering a specific Windows setting, without displaying the permission request that would usually be presented to the user.
The module named HBrowser raises the risk level by enabling the attacker to interact directly with the victim's browser. The operator can monitor the screen and perform actions on open pages, simulating remote use of the computer.
In practice, this functionality grants access to services where the victim already has authentication, eliminating the need for the attacker to guess passwords or start a new session. The mechanism is also capable of bypassing multi-factor authentication (MFA) requests, although the scope of this access depends on the security measures implemented in each service.
The spread of XWorm intensified in 2025, driven by the leak of the malware's own development tools. In June of that year, a modified version of the builder was released, and in August, the altered source code of version 6.4 also leaked. Netskope reported that detections grew after these disclosures and remained above previous levels.
Besides Brazil, other countries with high incidence of XWorm activity include India, Italy, Panama, and the United States. Financial services constitute about 35% of the client organizations affected.
Only in September 2026, 601 detection events were counted, corresponding to almost half of the total registered in the quarter, demonstrating that the malware remained active during the analyzed period.
For those who suspect an infection, it is recommended to check accounts using a different and secure device, in addition to inspecting the compromised computer to locate and remove the software. As long as XWorm is installed, criminals will maintain surveillance over the environment and use open browser sessions.