The leak of the XWorm builder has turned a well-known remote access trojan into a surveillance toolkit, with four distinct versions now circulating in the wild and a plugin catalogue that has grown to 46 components, according to new research from Netskope Threat Labs.
Netskope, which says it has been tracking XWorm since September 2024, reported that its detections of the malware increased roughly fourfold over the past year. The company attributes the growth less to a single aggressive campaign than to the diffusion effect created when a builder itself becomes public. Once the tooling is out, every actor who obtains it can produce their own builds — and those builds diverge.
Netskope's researchers identified four separate XWorm versions in active circulation, each carrying its own plugin set rather than a fixed, static implant. Because the versions carry no shared signature surface, in the researchers' account, an indicator-of-compromise list drawn from any one build covers only a fraction of what is being deployed, and blocking one family member does little to contain the others.
From implant to plugin ecosystem
The plugin architecture is where XWorm has changed most visibly. Beyond the capabilities expected of a conventional RAT — file exfiltration, credential theft, persistence — Netskope documented tools for geolocation, audio capture, and, most notably, live browser control.
Live browser control, Netskope's findings indicate, reaches further than credential theft. Rather than harvesting stored passwords or tokens, an attacker operating through a live browser session can act inside an authenticated session as the legitimate user. In environments where multi-factor authentication is treated as a hard stop, this represents a way around it: MFA is not defeated, it is simply never re-challenged, because the session was never ended. Such a session could give an attacker access to webmail, cloud consoles, and internal applications without ever triggering a fresh authentication prompt.
Why builder leaks are a durable problem
The XWorm case follows a pattern security teams have now seen repeatedly: an initial-access broker or affiliate loses control of the tooling, and the barrier to entry for using that tooling collapses. What follows is not one threat but many, splintering across forums and repackaged distributions.
For detection teams, the pattern implies that XWorm — or any builder-leaked malware family — should not be treated as a single object with a stable fingerprint. Indicators remain useful for retro-hunting and known-build blocking, but Netskope's findings suggest they are a partial control at best. The behavioural patterns the researchers describe — unusual plugin loading sequences, unexpected audio or browser-session activity, recurring outbound traffic profiles across otherwise unrelated samples — survive version drift in a way that file hashes and specific C2 domains do not.
The live-browser-control element also widens the defensive surface beyond the endpoint. Because the technique operates inside an already-authenticated session, the gap it exposes is one that signature-based detection does not reach — a point Netskope's report underscores by documenting the capability alongside more conventional RAT tooling.
For security operations teams running lean, the picture that emerges from Netskope's research is one of fragmentation rather than a single scaling campaign: many independent builds, diverging from a common leaked source. The mechanism — one leaked builder producing many divergent builds — is not specific to XWorm, and the local threat picture will vary from environment to environment.
Research by Netskope Threat Labs, published via Security Affairs.
根據 Netskope Threat Labs 的新研究，XWorm builder 的外洩已將這款知名的 remote access trojan 變成一套監察工具套件，現時野外流通的版本達四個，插件目錄亦增至 46 個元件。
據 Netskope 表示，該公司自 2024 年 9 月起一直追蹤 XWorm，過去一年間其對該惡意軟件的偵測次數增加約四倍。該公司將增幅主要歸因於 builder 本身公開後所產生的擴散效應，而非某一次積極的攻擊行動。一旦工具外流，每名取得它的攻擊者皆可製作自己的 build——而這些 build 會各自分化。
Netskope 研究人員識別出四個正在活躍流通的 XWorm 版本，每個版本各自配備不同的插件組合，而非固定不變的靜態 implant。據研究人員所述，這些版本並無共通的 signature 特徵，因此從任何單一 build 提取的 indicator-of-compromise（IOC）清單，僅涵蓋實際部署內容的一小部分，封鎖其中一個家族成員對其餘版本亦幾乎沒有約制作用。
從 implant 到插件生態系統
插件架構是 XWorm 變化最顯著之處。除了一般 RAT 預期的功能——檔案外洩、憑證盜取、持久化——Netskope 還記錄到用於地理定位、音訊擷取，以及最值得注意的即時瀏覽器控制（live browser control）的工具。
Netskope 的研究發現指出，即時瀏覽器控制的影響遠超乎憑證盜取。攻擊者透過即時瀏覽器 session 操作，可如合法用戶般在已認證的 session 內行事，而非僅僅竊取已儲存的密碼或 token。在多因素認證（MFA）被視為堅固防線的環境中，這代表一種繞過方式：MFA 並未被破解，只因 session 從未結束而不會再次受到驗證挑戰。此類 session 可讓攻擊者在完全不觸發新一輪認證提示的情況下，存取 webmail、cloud console 及內部應用程式。
為何 builder 外洩是難以根治的問題
XWorm 案例符合保安團隊屢見不鮮的模式：初始入侵中介（initial-access broker）或 affiliate 失去對工具的控制，使用該工具的門檻隨即崩塌。接踵而至的並非單一威脅，而是眾多威脅，在各大論壇四散並以重新包裝的形式流通。
對偵測團隊而言，此模式意味著 XWorm——或任何 builder 外洩的 malware 家族——不應被視為具有穩定指紋的單一物件。IOC 對追溯搜尋（retro-hunting）和已知 build 的封鎖仍然有用，但 Netskope 的研究發現指出，它充其量只是部分性的控制。研究人員描述的行為模式——不尋常的插件載入序列、預期以外的音訊或瀏覽器 session 活動、在其他方面互不相關的樣本中反覆出現的 outbound 流量特徵——能經受版本漂移的考驗，這是檔案雜湊值和特定 C2 domain 所做不到的。
即時瀏覽器控制這一元素亦令防禦範圍擴大至端點以外。由於該技術在已認證的 session 內運作，它所暴露的漏洞正是基於 signature 的偵測無法觸及之處——Netskope 報告將此功能與較傳統的 RAT 工具並列記錄，突顯了這一點。
對於精簡運作的安全營運團隊，Netskope 研究呈現的圖景是碎片化，而非單一不斷擴大的攻擊行動：眾多獨立的 build，從一個共同的外洩源頭各自分化。此機制——一個外洩的 builder 產生眾多分化的 build——並非 XWorm 獨有，而各地的具體威脅形勢會因環境而異。
研究由 Netskope Threat Labs 進行，並透過 Security Affairs 發表。