What is XWorm Official?

XWorm Official tracks versions, IOCs, news, changelogs, and MITRE techniques in 38 pages, helping defenders study malware changes and threats.

Version History

Complete XWorm Version History

A chronological timeline of XWorm from 2022 through 2026, distinguishing official, modified, cracked, and trojanized builds.

Latest verified version

XWorm 7.4 is the newest version independently verified by this site as of 2026-10-04. Primary evidence: ANY.RUN sandbox analysis; Point Wild / Lat61 infection-chain research. This field is updated when reliable evidence of newer versions emerges — it is not permanently declared "the current version."

7.4officialconfirmedLATEST VERIFIED2026-04-02

Independently observed in public malware-analysis systems during 2026. ANY.RUN analyzed a sample April 2, 2026; independent research May 14, 2026 documented a multi-stage infection delivering 7.4.

DEVELOPER: UnknownARCH: .NETSOURCE: ANY.RUN; Point Wild / Lat61

→ Detailed analysis

7.2officialconfirmed2026-02-10

FortiGuard Labs documented XWorm 7.2 in a multilingual business-themed phishing campaign. Infection chain used malicious Excel exploiting CVE-2018-0802. Version info: UD_XWormClient 7.2.

DEVELOPER: UnknownARCH: 32-bit .NET executableSOURCE: FortiGuard Labs

→ Detailed analysis

6.4modifiedhigh2025-08-01

Trellix reported a modified XWorm 6.4 builder appearing in August 2025, with source located for the modified branch. Not an original-developer release.

DEVELOPER: Unknown (post-original)ARCH: .NETSOURCE: Trellix

→ Detailed analysis

6.0officialhigh2025-06-04

Advertised June 4, 2025 by XCoderTools. Trellix reported substantial recoding and a highly modular architecture with 35+ plugin-related capabilities. June 27, 2025: cracked 6.0 builder appeared publicly.

DEVELOPER: XCoderToolsARCH: .NET (modular)SOURCE: Trellix

→ Detailed analysis

5.6officialhigh2024-01-01

Major widely circulated version during 2024. Trellix reported development associated with XCoder continued through 5.6. Late 2024: original XCoder account reportedly deleted and official support stopped.

DEVELOPER: XCoderARCH: .NETSOURCE: Trellix

→ Detailed analysis

2.x-4.xearlyhigh2022-08-19

Early generations publicly analyzed and commercially advertised. Trellix reported versions 4.1, 4.2 and 5.0 advertised for approximately $400 in 2023.

DEVELOPER: XCoder / EvilCoderARCH: .NETSOURCE: Cyble; Trellix

→ Detailed analysis

Build classification matters

Two samples both identified as "XWorm" may contain different plugins, persistence mechanisms, loaders, stealers, C2 configurations, and additional payloads. Never assume all modifications came from the original developer. See The Cracked XWorm Ecosystem.