Loading story…
Threat researchers reported that attackers increasingly used malicious Microsoft Excel add-in files with the .xll extension as an initial access vector, exploiting Excel's xlAutoOpen behavior to run code with a single user action. HP Wolf Security said the technique was being used to deliver malware including Dridex, Agent Tesla, Raccoon Stealer, and Formbook, and noted that some samples were built with the legitimate Excel-DNA framework while others were custom downloaders that decrypted embedded configuration data, resolved APIs dynamically, fetched payloads, and executed them. Researchers also observed underground promotion of XLL dropper builders, indicating the method was becoming commoditized.
Fortinet and SANS documented active spam operations using the format in the wild. One campaign used DHL and Amazon-themed lures to distribute a signed malicious XLL that downloaded csrsc.exe from dmequest[.]com, saved it as %PUBLIC%\srtherhaeth[.]eXe, and installed a Rust-based Buer Loader variant that communicated with shipmentofficedepot[.]com; the file was signed with a certificate assigned to HORUM, likely to reduce detection. Separately, SANS observed a Hancitor malspam wave using DocuSign-themed emails and Google feedproxy links that redirected victims through compromised sites to an XLL payload, which then retrieved an HTA file and a Hancitor executable from srand04rf[.]ru, followed by activity linked to Cobalt Strike and Ficker Stealer. Defenders were advised to block inbound XLL attachments, restrict add-ins to trusted signed files, or disable proprietary Excel add-ins where possible.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
On 2021-07-08, a Hancitor malspam wave used DocuSign-themed phishing emails to deliver a malicious Excel XLL add-in instead of the campaign's usual Word document. Enabling the add-in triggered immediate execution and led to Hancitor infection activity.
The SANS ISC report states that since 2021-06-08, Hancitor malspam changed from using docs.google.com links to feedproxy.google.com URLs in its phishing workflow.
Fortinet's report says the analyzed Buer Loader sample matched the newer Rust-based variant previously highlighted by Proofpoint in May 2021. The sample used Rust crates including whoami and communicated with shipmentofficedepot[.]com.
HP Wolf Security reported that recent malware campaigns increasingly used malicious Microsoft Excel XLL add-ins as an initial infection vector. The research tied XLL delivery to malware families including Dridex, Agent Tesla, Raccoon Stealer, and Formbook, and described both Excel-DNA-based and custom-built XLL malware.
FortiGuard Labs observed a broad spam campaign using DHL and Amazon-themed lures to distribute a signed malicious Excel XLL attachment named "Detailed Invoice.xll." When opened, the XLL executed via xlAutoOpen, downloaded csrsc.exe from dmequest[.]com, saved it locally, and installed Buer Loader.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 35 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
threatresearch.ext.hp.com
Open sourcefortinet.com
Open sourceisc.sans.edu
Open sourceexcel-dna.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are increasingly leveraging weaponized document formats and add-ins to compromise Windows users, with recent campaigns targeting organizations in multiple countries. One operation uncovered by researchers used phishing emails with RAR archives containing obfuscated JavaScript payloads, which exploited the CVE-2017-11882 vulnerability in Microsoft Office's Equation Editor. The infection chain included the use of malicious SVG files, ZIP archives with LNK shortcuts, and a sophisticated four-stage execution pipeline involving steganographically embedded .NET assemblies and the abuse of legitimate open-source libraries, all designed to evade detection and deliver commodity loaders for Remote Access Trojans and information stealers. Separately, attackers have been abusing Microsoft Excel's XLL add-in format to deliver malware, with a notable increase in such activity since 2021. Recent incidents include the submission of malicious XLL files to VirusTotal from Ukraine and Russia, which contained a backdoor named EchoGather capable of system reconnaissance, command execution, and file transfer. These XLL-based attacks often use open-source frameworks like Excel-DNA to facilitate payload delivery and in-memory execution, further complicating detection and mitigation efforts for targeted organizations.
Jun 29, 2026
Researchers documented multiple **XLoader/Formbook** delivery chains that used different initial access methods but converged on the same information-stealing malware. One campaign used spam emails with PDF attachments that led victims through embedded `XLSX` and downloaded `RTF` files, while another impersonated **SharePoint** to push users to a malicious ZIP archive. A separate Excel-based campaign exploited **`CVE-2017-11882`** in Microsoft Equation Editor (`EQNEDT32.exe`) through a malicious OLE object, triggering shellcode that downloaded and launched additional malware from attacker-controlled infrastructure. Across the campaigns, the loaders relied on layered obfuscation, in-memory execution, and repeated process injection before deploying the final **XLoader** payload. Analysts observed AutoIT-based loaders, anti-analysis delays, CRC32 API hashing, shellcode injection into processes including `svchost.exe`, `netsh.exe`, and `explorer.exe`, and payload components hidden in bitmap resources and unpacked with steganography or decompression routines. The final malware established persistence through **HKCU Run** keys and shortcut artifacts, used process hollowing, and stole credentials, cookies, keystrokes, clipboard contents, and screenshots while maintaining command-and-control channels that could fetch additional payloads or remove the malware.
Aug 15, 2026
FIN7 has continued to evolve its malware delivery and post-compromise tooling, with multiple reports tying the group to campaigns that use malicious Excel add-ins (`.xll`) to deliver a rewritten **JSSLoader**. Malwarebytes reported a late-June malspam operation in which an XLL component launched JSSLoader and dropped a secondary .NET payload, while later reporting from Morphisec and Secureworks also linked new JSSLoader activity to Excel add-ins. Researchers said the newer JSSLoader variants expand on earlier versions with added functionality, including enhanced data-exfiltration capabilities. The activity fits a broader pattern in FIN7 intrusions documented by Mandiant, which showed the group shifting from older loaders such as **LOADOUT** and **GRIFFON** toward more flexible access tools including **POWERPLANT** and **Cobalt Strike BEACON**, while continually rewriting malware to evade detection. Mandiant also described FIN7 using compromised RDP credentials, shellcode loaders, reconnaissance, Kerberoasting, and customized backdoors, underscoring that the latest JSSLoader delivery chain is part of a longer-running effort by the financially motivated group to refine initial access, persistence, and follow-on intrusion capability.
Aug 15, 2026