XWorm HBrowser Plugin Lets Attackers Control Authenticated Browser Sessions Without Credentials

Netskope Threat Labs reports that XWorm’s HBrowser plugin provides operators interactive control of victims’ authenticated browser sessions—allowing account operations without credential theft or defeating MFA—and that the toolkit has expanded into a broader surveillance platform (location, microphone, webcam). Telemetry recorded 1,236 detections across 100+ customer organizations in Q3 2026 (not global counts), with financial services heavily affected; multiple actively circulating XWorm versions and plugins have increased functionality and detections since mid-2025.