XWorm, a remote access trojan (RAT), has evolved into a more capable surveillance platform, according to SecurityWeek. The malware's expanded plugin count now lets operators monitor a victim's location, stream live audio from the device, and interact with authenticated browser sessions. These features go beyond typical RAT functions like file theft or keystroke logging, positioning XWorm as a tool for real-time spying.
The ability to interact with authenticated browser sessions is particularly notable, as it could allow attackers to perform actions as the logged-in user without needing credentials. Combined with location tracking and audio streaming, the malware offers a broad view of a target's activities. SecurityWeek notes the expansion as a key development in the malware's evolution, though it does not specify which threat actors are using the new plugins or how they are distributed.
For defenders, the update underscores the importance of monitoring for unusual audio device usage, location requests, or browser session anomalies on endpoints. As RATs continue to add surveillance features, the line between remote access and covert monitoring becomes increasingly thin.