In September 2024, Netskope Threat Labs first reported on XWorm and its infection chain. The following year, in July 2025, we reported version 6.0 and its more advanced features. As we continued tracking the malware over the past year, we identified four distinct XWorm versions operating concurrently in the wild. Detection volume remains elevated, with Netskope Threat Labs recording 1,236 events across more than 100 customer organizations in Q3 2026, marking a 4x increase over Q3 2025. The public leak of the V6.4 builder in mid-2025 drove this initial surge, keeping activity consistently above pre-leak baselines ever since. The financial services sector accounts for approximately 35% of affected customers, with activity concentrated in India, Brazil, Italy, Panama, and the United States.
