Loading story…
Multiple investigations detailed FormBook being delivered through phishing lures that abused disguised attachments, malicious .pps files, RAR archives with fake PDF .lnk files, and PowerShell droppers masquerading as images such as ad.jpg. Across the campaigns, the initial stages launched heavily obfuscated PowerShell, HTA, VBScript, or .NET loaders that used Base64, AES, GZip, XOR decoding, AMSI bypasses, and staged payload extraction to retrieve additional components from attacker-controlled domains. Analysts observed decoy documents, shortened URLs, and NSIS-based installers used to conceal the infection chain before the malware was injected into legitimate Windows processes such as AddInProcess32.exe, ImagingDevices.exe, and other suspended binaries.
The final FormBook payload consistently used process hollowing, shared-memory injection, duplicated ntdll.dll, API hashing, anti-VM, anti-sandbox, anti-debugging, and even Heaven’s Gate transitions to evade analysis and endpoint defenses. Once running, the infostealer harvested system details, browser and email credentials, cookies, autofill data, clipboard contents, proxy settings, and data from messaging and FTP clients, then exfiltrated the information over obfuscated, encrypted, and Base64-encoded HTTP traffic to rotating command-and-control infrastructure. Researchers also documented operator commands that let attackers download and execute files, run commands, wipe browser data, remove the malware, and reboot or shut down infected systems.
Pull IOCs and campaign context straight into your stack.
9 events from the most recent confirmed update back to the earliest known activity.
FortiGuard Labs reported on a FormBook variant running inside ImagingDevices.exe that used duplicated ntdll.dll, Heaven’s Gate transitions, anti-VM and anti-debugging checks, and process hollowing into SysWOW64 binaries such as PATHPING.EXE. The report also documented a separate injected socket process for C2 communications, theft of browser and Outlook data, and 64 obfuscated C2 domains.
FortiGuard Labs reported a phishing campaign using a fake sales-order Word document that loaded an external RTF via altChunk and exploited CVE-2017-11882 in Microsoft Equation Editor to run a disguised DLL named AdobeID.pdf through rundll32.exe. The DLL established persistence, downloaded and decrypted an in-memory payload masquerading as a PNG file, and hollowed ImagingDevices.exe to execute a fileless FormBook variant; Fortinet also published related IOCs.
A researcher described a phishing campaign in which a RAR archive contained a disguised PDF-themed LNK file that launched PowerShell, retrieved an HTA from thanhancompany[.]com, and executed a multi-stage PowerShell chain. The infection downloaded a decoy PDF and a .NET payload named 883.exe, which unpacked the final FormBook malware.
A malware analysis write-up examined a FormBook sample delivered as a 32-bit NSIS installer that extracted a DLL and staged files, decoded hicclc.io with a hardcoded XOR key, and used shellcode plus process hollowing to run the final payload. The analysis highlighted fresh NTDLL mapping for EDR evasion and credential theft targeting browsers, cookies, clipboard data, and stored credentials.
Quick Heal published analysis of a FormBook variant that used steganography and multi-stage in-memory loading to steal data. The report characterized it as a returning/new variant with updated delivery and execution tradecraft.
In part II of its analysis, FortiGuard Labs described how the FormBook payload injected into AddInProcess32.exe duplicated ntdll.dll, performed anti-analysis checks, injected into Explorer.exe, and then into a suspended Windows process such as ipconfig.exe. The report also documented process targeting for credential theft and command-and-control support.
FortiGuard Labs reported a phishing campaign using a malicious PowerPoint .pps attachment masquerading as a purchase-order reply to infect Windows users with a new FormBook variant. The attachment triggered VBA macros that launched PowerShell, downloaded additional code from a shortened URL resolving to kiibra[.]com, reconstructed item3.jpg, and ultimately injected FormBook into AddInProcess32.exe.
SANS ISC analyzed a malicious file named ad.jpg that was actually a Base64-encoded PowerShell script using an AMSI bypass, in-memory DLL loading, and anti-VM checks before executing a final FormBook payload. The analysis identified multiple contacted domains and noted the sample and extracted payloads were not present on VirusTotal at the time of analysis.
Malware-Traffic-Analysis.net documented a FormBook infection run observed on 2023-06-05 involving a RAR archive named "Release_pending_bookings_now.rar" that contained a Windows executable disguised with an Adobe PDF-style icon. The malware established persistence via the HKCU Run key, staged screenshots and credential-recovery files under the user's Roaming profile, and sent stolen data via HTTP POST requests to multiple domains, with qfs-capital[.]com appearing to accept the exfiltrated data.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 247 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
9 references tracked. Mallory keeps watching after this page renders.
fortinet.com
Open sourcefortinet.com
Open sourcekienmanowar.wordpress.com
Open sourcegithub.com
Open sourcemalware-traffic-analysis.net
Open sourceblogs.quickheal.com
Open sourcefortinet.com
Open sourcefortinet.com
Open sourceisc.sans.edu
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers analyzed two Formbook/XLoader delivery chains that show operators refreshing distribution methods while reusing the same infostealer core. One March 2026 sample used a three-layer AutoIt v3 wrapper that dropped an intermediate file named `intersentimental` into `%TEMP%`, decrypted it with the recoverable 20-byte XOR key `WADEJD3GLJQWUK1CSRTG`, and launched shellcode to hollow legitimate Windows processes with a reused Formbook payload. The sample combined anti-analysis techniques including dead-code-heavy AutoIt scripting, custom string obfuscation, fake .NET CLR metadata, empty imports, API hashing, anti-debug checks, and Formbook’s RC4/SHA1-based self-decryption, while exposed build artifacts pointed to operator OPSEC failures such as a XAMPP-based build path, use of the default Windows Administrator account, clustered build times, and static XOR key reuse. A separate campaign delivered Formbook through a 38,000-line, 1.54 MB VBScript dropper that used WMI, PowerShell, steganography, and IPFS-hosted payloads to evade detection and resist takedown. The script launched a hidden PowerShell stage via `Win32_Process.Create`, fetched fake JPEG files from `gateway.lighthouse.storage`, extracted a reversed Base64-encoded .NET assembly hidden between custom markers, and invoked `Fiber.Program.Main` through reflection before creating a scheduled task and injecting the final payload into `wscript.exe`. Lure names such as `KIZAD_WSP-2025-PRO.vbs` suggest possible targeting of logistics, manufacturing, construction, or commercial organizations in the UAE or broader Gulf region.
Jun 29, 2026
Researchers detailed how **XLoader**, the successor to **FormBook**, has evolved from a credential-stealing crimeware kit into a **malware-as-a-service** operation that rents command-and-control infrastructure while preserving FormBook’s core capabilities, including form grabbing, keylogging, screenshot capture, and theft of stored application credentials. Recent technical analysis shows XLoader remains active on **Windows and macOS** and now relies on heavier anti-analysis protections, including encrypted `PUSHEBP` blocks, custom virtual-machine logic, layered string and configuration encryption, decoy C2 domains, and multi-stage use of **RC4**, **XOR**, **Base64**, and modified hashing routines to conceal its real network infrastructure and internal configuration. The malware has continued to appear in varied delivery campaigns, including malicious spreadsheets that abuse the Office password **"VelvetSweatshop"** to auto-decrypt embedded content and fetch payloads, as well as email lures carrying compressed **VBS** attachments that establish persistence, download additional stages with PowerShell, and inject the final infostealer into legitimate processes such as `calc.exe` and `explorer.exe`. Earlier FormBook campaigns also targeted victims in the **U.S. and South Korea**, underscoring the family’s long-running operational use, while newer XLoader versions add further protocol changes such as a `PKT2` registration layer and even exhibit a coding flaw that can suppress transmission of host details including version, operating system, and username during C2 registration.
Aug 15, 2026
Researchers documented multiple **XLoader/Formbook** delivery chains that used different initial access methods but converged on the same information-stealing malware. One campaign used spam emails with PDF attachments that led victims through embedded `XLSX` and downloaded `RTF` files, while another impersonated **SharePoint** to push users to a malicious ZIP archive. A separate Excel-based campaign exploited **`CVE-2017-11882`** in Microsoft Equation Editor (`EQNEDT32.exe`) through a malicious OLE object, triggering shellcode that downloaded and launched additional malware from attacker-controlled infrastructure. Across the campaigns, the loaders relied on layered obfuscation, in-memory execution, and repeated process injection before deploying the final **XLoader** payload. Analysts observed AutoIT-based loaders, anti-analysis delays, CRC32 API hashing, shellcode injection into processes including `svchost.exe`, `netsh.exe`, and `explorer.exe`, and payload components hidden in bitmap resources and unpacked with steganography or decompression routines. The final malware established persistence through **HKCU Run** keys and shortcut artifacts, used process hollowing, and stole credentials, cookies, keystrokes, clipboard contents, and screenshots while maintaining command-and-control channels that could fetch additional payloads or remove the malware.
Aug 15, 2026