#Xworm

XWorm is a modular .NET Remote Access Trojan and stealer first observed around 2022. It combines keylogging, screen and webcam capture, and credential theft from apps like Telegram, Discord and MetaMask with a plugin system that lets the operator load extra modules per victim, including an optional ransomware plugin. It is not open-source; cracked copies of its builder circulate on underground forums and Telegram channels, most recently a leaked v6.0 build in 2025.

Most often via phishing email attachments, malicious script loaders (VBS, JS or PowerShell) and trojanised software downloads posing as cracked or pirated tools - the same loader ecosystem used to distribute njRAT and AsyncRAT. The malware does not exploit a vulnerability to install; it relies on the victim executing the dropper.

Every 15 minutes. The TweetFeed pipeline scrapes RSS feeds from public Twitter/X security researcher accounts and lists, extracts IOCs, tags them with the relevant malware family or threat actor, and republishes the result in CSV, JSON and RSS. Xworm-tagged IOCs are surfaced on this page within the next 15-minute tick. The page itself is regenerated daily by a GitHub Action.

All TweetFeed IOC data, including this Xworm subset, is released under CC0 1.0 Universal (Public Domain Dedication). No attribution required, no warranty. Commercial use is allowed. The TweetFeed website code and branding are not covered by CC0.