Capability Matrix
XWorm Capability Matrix
Documented XWorm capabilities organized by functional category, with source attribution. Capability presence varies by version, plugin, and campaign.
AUTHOR: Threat Intelligence Research TeamUPDATED: 2026-10-04VERIFIED: 2026-10-04
Surveillance
Microsoft; Trellix- ›Keylogging
- ›Screenshots
- ›Webcam monitoring
- ›Microphone / audio access
- ›Active-window monitoring
- ›Clipboard monitoring
Credential / Information Theft
Microsoft Security Intelligence- ›Browser credentials
- ›Stored passwords
- ›Cookies / session data
- ›Autofill information
- ›MetaMask-related information
- ›Telegram session-related information
- ›Clipboard cryptocurrency addresses
System Control
Trellix; Fortinet- ›Remote shell
- ›Process interaction
- ›File management
- ›Upload / download
- ›Additional payload execution
- ›Shutdown / restart
- ›Remote desktop capabilities
Reconnaissance
Multiple vendors- ›Username
- ›Computer name
- ›OS
- ›Architecture
- ›Hardware / GPU
- ›Security products
- ›Installed software
- ›Network info
- ›Process info
Financial / Cryptocurrency Abuse
Trellix (2023)- ›Clipboard monitoring
- ›Cryptocurrency-address replacement
- ›Browser-wallet exposure
Impact
Multiple vendors- ›File encryption / ransomware-like capability (some plugins)
- ›Disruptive operations
- ›DDoS functionality (some plugins)
- ›Additional malware deployment
Important disclaimer
The existence of a ransomware or DDoS module does not mean every XWorm infection uses those functions. Some capabilities are plugin-specific or campaign-specific.
