Loading story…
Researchers analyzed two Formbook/XLoader delivery chains that show operators refreshing distribution methods while reusing the same infostealer core. One March 2026 sample used a three-layer AutoIt v3 wrapper that dropped an intermediate file named intersentimental into %TEMP%, decrypted it with the recoverable 20-byte XOR key WADEJD3GLJQWUK1CSRTG, and launched shellcode to hollow legitimate Windows processes with a reused Formbook payload. The sample combined anti-analysis techniques including dead-code-heavy AutoIt scripting, custom string obfuscation, fake .NET CLR metadata, empty imports, API hashing, anti-debug checks, and Formbook’s RC4/SHA1-based self-decryption, while exposed build artifacts pointed to operator OPSEC failures such as a XAMPP-based build path, use of the default Windows Administrator account, clustered build times, and static XOR key reuse.
A separate campaign delivered Formbook through a 38,000-line, 1.54 MB VBScript dropper that used WMI, PowerShell, steganography, and IPFS-hosted payloads to evade detection and resist takedown. The script launched a hidden PowerShell stage via Win32_Process.Create, fetched fake JPEG files from gateway.lighthouse.storage, extracted a reversed Base64-encoded .NET assembly hidden between custom markers, and invoked Fiber.Program.Main through reflection before creating a scheduled task and injecting the final payload into wscript.exe. Lure names such as KIZAD_WSP-2025-PRO.vbs suggest possible targeting of logistics, manufacturing, construction, or commercial organizations in the UAE or broader Gulf region.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
On 2026-04-20, WatchGuard reported two FormBook phishing campaigns targeting organizations in parts of Europe and Latin/Central America. One used archive lures themed around orders or payments and abused Sandboxie-plus for DLL side-loading, while the other used an obfuscated JavaScript dropper, PowerShell, and a custom .NET loader to deploy FormBook.
On 2026-03-12, Breakglass Intelligence reported a separate Formbook infection chain built around a 38,000-line obfuscated VBScript dropper that used WMI, PowerShell, steganography, and IPFS-hosted payloads. The chain established persistence with a scheduled task and ultimately injected Formbook into wscript.exe, with lure naming suggesting possible targeting in the UAE or Gulf region.
In a report published on 2026-03-12, Breakglass Intelligence analyzed a March 2026 Formbook/XLoader sample using a three-layer chain: an AutoIt wrapper, an XOR-encrypted intermediate payload, and a reused Formbook core. The report also exposed operator OPSEC weaknesses including a XAMPP-based build path, default Administrator usage, clustered build times, static XOR key reuse, and released hashes, detections, and hunting artifacts.
The outer AutoIt v3 loader in the analyzed Formbook/XLoader chain was compiled on 2026-03-05. The wrapper dropped an XOR-encrypted intermediate payload, decrypted it with a recoverable 20-byte key, and launched shellcode for process hollowing into legitimate Windows processes.
Breakglass found that the decrypted Formbook core embedded in the March 2026 sample carried a compile timestamp of 2021-05-23, indicating operators reused an older base kit rather than rebuilding the malware core. This predates the newer delivery wrapper used in the 2026 activity.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 30 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
watchguard.com
Open sourceintel.breakglass.tech
Open sourceintel.breakglass.tech
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple investigations detailed **FormBook** being delivered through phishing lures that abused disguised attachments, malicious `.pps` files, RAR archives with fake PDF `.lnk` files, and PowerShell droppers masquerading as images such as `ad.jpg`. Across the campaigns, the initial stages launched heavily obfuscated PowerShell, HTA, VBScript, or .NET loaders that used Base64, AES, GZip, XOR decoding, AMSI bypasses, and staged payload extraction to retrieve additional components from attacker-controlled domains. Analysts observed decoy documents, shortened URLs, and NSIS-based installers used to conceal the infection chain before the malware was injected into legitimate Windows processes such as `AddInProcess32.exe`, `ImagingDevices.exe`, and other suspended binaries. The final FormBook payload consistently used **process hollowing**, shared-memory injection, duplicated `ntdll.dll`, API hashing, anti-VM, anti-sandbox, anti-debugging, and even **Heaven’s Gate** transitions to evade analysis and endpoint defenses. Once running, the infostealer harvested system details, browser and email credentials, cookies, autofill data, clipboard contents, proxy settings, and data from messaging and FTP clients, then exfiltrated the information over obfuscated, encrypted, and Base64-encoded HTTP traffic to rotating command-and-control infrastructure. Researchers also documented operator commands that let attackers download and execute files, run commands, wipe browser data, remove the malware, and reboot or shut down infected systems.
Aug 15, 2026
Researchers detailed how **XLoader**, the successor to **FormBook**, has evolved from a credential-stealing crimeware kit into a **malware-as-a-service** operation that rents command-and-control infrastructure while preserving FormBook’s core capabilities, including form grabbing, keylogging, screenshot capture, and theft of stored application credentials. Recent technical analysis shows XLoader remains active on **Windows and macOS** and now relies on heavier anti-analysis protections, including encrypted `PUSHEBP` blocks, custom virtual-machine logic, layered string and configuration encryption, decoy C2 domains, and multi-stage use of **RC4**, **XOR**, **Base64**, and modified hashing routines to conceal its real network infrastructure and internal configuration. The malware has continued to appear in varied delivery campaigns, including malicious spreadsheets that abuse the Office password **"VelvetSweatshop"** to auto-decrypt embedded content and fetch payloads, as well as email lures carrying compressed **VBS** attachments that establish persistence, download additional stages with PowerShell, and inject the final infostealer into legitimate processes such as `calc.exe` and `explorer.exe`. Earlier FormBook campaigns also targeted victims in the **U.S. and South Korea**, underscoring the family’s long-running operational use, while newer XLoader versions add further protocol changes such as a `PKT2` registration layer and even exhibit a coding flaw that can suppress transmission of host details including version, operating system, and username during C2 registration.
Aug 15, 2026
Researchers documented multiple **XLoader/Formbook** delivery chains that used different initial access methods but converged on the same information-stealing malware. One campaign used spam emails with PDF attachments that led victims through embedded `XLSX` and downloaded `RTF` files, while another impersonated **SharePoint** to push users to a malicious ZIP archive. A separate Excel-based campaign exploited **`CVE-2017-11882`** in Microsoft Equation Editor (`EQNEDT32.exe`) through a malicious OLE object, triggering shellcode that downloaded and launched additional malware from attacker-controlled infrastructure. Across the campaigns, the loaders relied on layered obfuscation, in-memory execution, and repeated process injection before deploying the final **XLoader** payload. Analysts observed AutoIT-based loaders, anti-analysis delays, CRC32 API hashing, shellcode injection into processes including `svchost.exe`, `netsh.exe`, and `explorer.exe`, and payload components hidden in bitmap resources and unpacked with steganography or decompression routines. The final malware established persistence through **HKCU Run** keys and shortcut artifacts, used process hollowing, and stole credentials, cookies, keystrokes, clipboard contents, and screenshots while maintaining command-and-control channels that could fetch additional payloads or remove the malware.
Aug 15, 2026