XWorm's 46 plugins now include one that drives a victim's logged-in browser

The operator's side of HBrowser is plain. It receives a continuous stream of screenshots, and the victim machine executes each input the operator sends in the active browser window ^[8]. Netskope calls the result a full remote browser session. "Every authenticated tab is accessible, bypassing the need for logging in and dealing with MFA," Netskope said ^[9].

In our view, the claim that HBrowser bypasses MFA stands, on one condition. The plugin runs on the victim's system ^[7], so the host must already be infected. Once it is, Netskope says the operator needs no credential ^[5]. The SecurityWeek summary does not say how XWorm reaches hosts, whether one group or several operate it, or which indicators to hunt for. Webcam capture is not new; the base RAT already offered it ^[1].

The growth looks like sustained development. The net addition is 11 plugins, about 31% on the July 2025 base ^[13]. That base sits one month after the builder was cracked in June 2025 and one month before the 6.4 source leaked in August 2025 ^[12]. Every added plugin therefore arrived while the cracked builder was public ^[12]. Netskope ties the rise in XWorm activity to that builder release ^[10], and its forecast is direct. "Since its builder and source code were leaked, we expect continued upgrades and use of this toolkit," Netskope said ^[11].