How a leaked builder of XWorm turned a remote access trojan into a surveillance kit

Netskope Threat Labs reports that a leaked builder has turned the XWorm remote access trojan into a broader surveillance kit. The team tracks four XWorm versions in the wild with 46 plugins, including tools for location, audio, and live browser control, and says detections are up fourfold.