Discover how 46 XWorm malware plugins enable covert audio spying, browser session hijacking, and persistence that survives a full Windows factory reset.

#XWorm #Malware #Cybersecurity #RAT #InfoSec

XWorm's leaked builder now hijacks logged-in browser sessions to skip MFA, and spies via mic and GPS. https://intel.threadlinqs.com/threat/TL-2026-3475 #ThreatIntel #XWorm #GenVariantApplicationLazy #TrojanGeneric

XWorm now hijacks logged-in browser sessions and listens through your mic - MFA does not help. https://intel.threadlinqs.com/threat/TL-2026-3434 #ThreatIntel #XWorm #LocaltoNet #XBinder

XWorm now hijacks live browser sessions and records your mic—threat level just spiked. #Malware #XWorm #Cybersecurity #ThreatIntel #BrowserHijack #LiveSession #SecurityNews https://thedailytechfeed.com/xworm-threat-gains-stealthy-new-tools-for-spying-session-hijacking/

🚨 XWorm has gone from infostealer to surveillance platform 🕵️

@threatlabs.netskope.com found 4 new versions and 46 plugins, including silent GPS 📍, live mic streaming 🎙️ and HBrowser session hijacking that bypasses MFA 🔓

📈 4x detections YoY

threatlabs.netskope.com/blog/2026/09...

#XWorm #Malware

XWorm is back as a plugin platform - rootkit, webcam spying and ransomware loaded in memory on demand. https://intel.threadlinqs.com/threat/TL-2026-3363 #ThreatIntel #XWorm #Remcos #XCoderTools

#xworm #opendir at:

http://107.173.143\.44/60

c2: 151.241.154\.23:7007

— from @James_inthe_box (https://x.com/James_inthe_box/status/2107491399730073763)

#xworm #opendir at:

http://107.173.143\\.44/60

c2: 151.241.154\\.23:7007

2CLoader malware dodges sandboxes and security tools to deliver Vidar and Remus infostealers. See how it works and how to detect it.

#2CLoader #Vidar #Remus #XWorm #Infostealer #MalwareLoader #ThreatLabz #CyberSecurity

ThreatLabz tracked 2CLoader, a Windows loader using anti-analysis and HTTP C2 to deliver Vidar, Remus, and XWorm via XOR-encrypted JSON. #2CLoader #Vidar #XWorm

2CLoader binds its AES key to its own .text hash, then drops Vidar, Remus and XWorm. https://intel.threadlinqs.com/threat/TL-2026-2819 #ThreatIntel #XWorm #Vidar #Remus

Two new posts with #pcap, #malware, other files and #indicators for #XWorm (Tuesday, 2026-09-08) and #AMOS #Stealer (Thursday, 2026-09-10).

www.malware-traffic-analysis.net/2026/index.h...

Lua loader hides in fake .ttf font files - fileless RATs via VEH-encrypted shellcode. https://intel.threadlinqs.com/threat/TL-2026-2402 #ThreatIntel #Rakhni #Agent #XWorm