XWorm HBrowser Plugin Lets Attackers Control Authenticated Browser Sessions Without Credentials

XWorm’s HBrowser plugin gives attackers interactive control of authenticated browser sessions on infected endpoints, allowing them to operate accounts without stealing passwords or completing another multifactor authentication challenge.

Researchers recorded 1,236 XWorm detection events across more than 100 customer organizations during Q3 2026, four times the volume observed in Q3 2025.

Financial services represented approximately 35% of affected customers, with activity concentrated in India, Brazil, Italy, Panama, and the United States. These figures describe Netskope’s customer telemetry, not a global infection count.

Available since version 6, HBrowser lets an operator select a target browser through the XWorm control panel. The panel sends an OpenBrowser command containing the browser identifier and display dimensions through the malware’s command-and-control channel.

The infected endpoint executes subsequent inputs while continuously returning screenshots, creating an interactive remote browsing session.

Supported commands relay keyboard characters, mouse clicks, cursor movement, scrolling, and pasted clipboard text. Keyboard and clipboard payloads use base64 encoding, while commands travel through XWorm’s standard AES-encrypted C2 channel.

This architecture lets attackers act directly inside the victim’s browser rather than exporting credentials for use elsewhere.

The authentication distinction is critical: HBrowser does not break MFA cryptography or defeat the initial verification process.

It exploits access already established by the legitimate user. Existing authenticated tabs become available to the operator, eliminating the need for another login unless the application independently demands reauthentication.

Netskope Threat Labs’ latest investigation said that, documents the malware’s expansion from information theft into a broader surveillance platform, combining browser control, location tracking, live microphone access, and webcam capture.

XWorm HBrowser Plugin

A cracked builder surfaced publicly in June 2025, followed by modified version 6.4 source code in August.

Netskope associated these releases with sharply increased activity: detections rose more than fourfold between Q3 and Q4 2025, reached seven times the original baseline in Q1 2026, and remained elevated throughout Q2.

September contributed 601 detections to Q3’s total.

Four versions now circulate concurrently: V6.4, V6.5 “XWorm Reborn,” V7.2, and V7.4.

Their changes include KeyAuth licensing, additional plugins, native-code obfuscation, anti-virtual-machine checks, an XBinder dropper, NTdll.dll unhooking, and LocaltoNet C2 infrastructure.

The confirmed plugin inventory increased from 35 to 46 since Netskope’s July 2025 analysis.

That earlier XWorm V6 investigation documented in-memory execution, AMSI bypass access, registry persistence, and critical-process protection, establishing the technical foundation for the toolkit’s continuing expansion.

The Maps plugin writes Allow to the current user’s Windows CapabilityAccessManager location-consent registry setting before requesting coordinates through GeoCoordinateWatcher.

It waits up to 15 seconds for location acquisition and falls back to IP-based geolocation when GPS is unavailable. According to the analysis, the registry change persists, suppressing subsequent consent prompts.

Microphone uses NAudio’s WaveInEvent to enumerate recording devices and capture 8 kHz, 16-bit mono audio in 500-millisecond buffers.

Each buffer is gzip-compressed, base64-encoded, and transmitted through AES-128-ECB-encrypted communications. Operators can select the device, stop recording, or terminate the session remotely.

Together, these capabilities turn endpoint compromise into both account access and environmental surveillance.

The latest Netskope report underscores why authenticated sessions remain exposed when malware controls the endpoint: protecting login credentials alone cannot prevent an attacker from using access already active inside a compromised browser.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.