Loading story…
Researchers detailed how XLoader, the successor to FormBook, has evolved from a credential-stealing crimeware kit into a malware-as-a-service operation that rents command-and-control infrastructure while preserving FormBook’s core capabilities, including form grabbing, keylogging, screenshot capture, and theft of stored application credentials. Recent technical analysis shows XLoader remains active on Windows and macOS and now relies on heavier anti-analysis protections, including encrypted PUSHEBP blocks, custom virtual-machine logic, layered string and configuration encryption, decoy C2 domains, and multi-stage use of RC4, XOR, Base64, and modified hashing routines to conceal its real network infrastructure and internal configuration.
The malware has continued to appear in varied delivery campaigns, including malicious spreadsheets that abuse the Office password "VelvetSweatshop" to auto-decrypt embedded content and fetch payloads, as well as email lures carrying compressed VBS attachments that establish persistence, download additional stages with PowerShell, and inject the final infostealer into legitimate processes such as calc.exe and explorer.exe. Earlier FormBook campaigns also targeted victims in the U.S. and South Korea, underscoring the family’s long-running operational use, while newer XLoader versions add further protocol changes such as a PKT2 registration layer and even exhibit a coding flaw that can suppress transmission of host details including version, operating system, and username during C2 registration.
Pull IOCs and campaign context straight into your stack.
10 events from the most recent confirmed update back to the earliest known activity.
SentinelOne reported a new macOS XLoader variant written in C and Objective-C and distributed as a signed disk image named OfficeNote.dmg, marking a shift from the earlier Java-based macOS version. The analysis described persistence via a LaunchAgent, theft of clipboard and browser credentials, anti-analysis features, and active distribution indicated by multiple VirusTotal uploads in July 2023.
ASEC reported a phishing campaign distributing Formbook through compressed attachments containing VBS files disguised as estimate-related documents. The infection chain used wisewomanwarrior[.]com staging URLs, injected payloads via calc.exe, and communicated with C2 at www.bumabagi[.]com/p7n9/.
A February 2022 analysis detailed a malicious password-protected Excel spreadsheet using the Office password "VelvetSweatshop" and an embedded OLE object to download and execute a payload later identified as XLoader/FormBook. Network and memory evidence tied the infection chain to FormBook/XLoader activity, including C2 traffic to www.appleburyschool[.]com.
A January 2022 VMRay analysis described XLoader as a FormBook rebrand with macOS support and examined XBinder, a Java-based builder that packages Windows and macOS payloads into one cross-platform archive. The report also documented platform-specific execution, persistence, anti-analysis behavior, and HTTP C2 markers used by FormBook/XLoader.
The operators rebranded Formbook as Xloader in October 2020. The rebrand also introduced notable changes to the malware, especially around command-and-control encryption.
Formbook sales stopped abruptly on October 6, 2017, with the seller stating the malware's use in spam campaigns was the reason. The operator reportedly banned customers who used Formbook in email campaigns.
FireEye documented significant FormBook distribution campaigns affecting targets in the United States and South Korea. This reflects active large-scale malware distribution in the wild.
The source code for Formbook’s web-based command-and-control panel was leaked. Later reporting says this leak preceded the operators’ shift away from distributing the full panel code to customers.
Formbook was being sold in hacking forums as a ready-to-use crimeware offering. This marked its emergence as a malware family available to cybercriminal customers.
After the panel code leak and the Xloader rebrand, the operators stopped selling the panel code with the malware executable and instead rented command-and-control infrastructure to customers. This represented a move to a malware-as-a-service model.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 90 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
11 references tracked. Mallory keeps watching after this page renders.
zscaler.com
Open sourcezscaler.com
Open sourcebotconf.eu
Open sourcesentinelone.com
Open sourceresearch.checkpoint.com
Open sourcevirusbulletin.com
Open sourcefireeye.com
Open sourcenetscout.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers documented multiple **XLoader/Formbook** delivery chains that used different initial access methods but converged on the same information-stealing malware. One campaign used spam emails with PDF attachments that led victims through embedded `XLSX` and downloaded `RTF` files, while another impersonated **SharePoint** to push users to a malicious ZIP archive. A separate Excel-based campaign exploited **`CVE-2017-11882`** in Microsoft Equation Editor (`EQNEDT32.exe`) through a malicious OLE object, triggering shellcode that downloaded and launched additional malware from attacker-controlled infrastructure. Across the campaigns, the loaders relied on layered obfuscation, in-memory execution, and repeated process injection before deploying the final **XLoader** payload. Analysts observed AutoIT-based loaders, anti-analysis delays, CRC32 API hashing, shellcode injection into processes including `svchost.exe`, `netsh.exe`, and `explorer.exe`, and payload components hidden in bitmap resources and unpacked with steganography or decompression routines. The final malware established persistence through **HKCU Run** keys and shortcut artifacts, used process hollowing, and stole credentials, cookies, keystrokes, clipboard contents, and screenshots while maintaining command-and-control channels that could fetch additional payloads or remove the malware.
Aug 15, 2026
Multiple investigations detailed **FormBook** being delivered through phishing lures that abused disguised attachments, malicious `.pps` files, RAR archives with fake PDF `.lnk` files, and PowerShell droppers masquerading as images such as `ad.jpg`. Across the campaigns, the initial stages launched heavily obfuscated PowerShell, HTA, VBScript, or .NET loaders that used Base64, AES, GZip, XOR decoding, AMSI bypasses, and staged payload extraction to retrieve additional components from attacker-controlled domains. Analysts observed decoy documents, shortened URLs, and NSIS-based installers used to conceal the infection chain before the malware was injected into legitimate Windows processes such as `AddInProcess32.exe`, `ImagingDevices.exe`, and other suspended binaries. The final FormBook payload consistently used **process hollowing**, shared-memory injection, duplicated `ntdll.dll`, API hashing, anti-VM, anti-sandbox, anti-debugging, and even **Heaven’s Gate** transitions to evade analysis and endpoint defenses. Once running, the infostealer harvested system details, browser and email credentials, cookies, autofill data, clipboard contents, proxy settings, and data from messaging and FTP clients, then exfiltrated the information over obfuscated, encrypted, and Base64-encoded HTTP traffic to rotating command-and-control infrastructure. Researchers also documented operator commands that let attackers download and execute files, run commands, wipe browser data, remove the malware, and reboot or shut down infected systems.
Aug 15, 2026
Researchers analyzed two Formbook/XLoader delivery chains that show operators refreshing distribution methods while reusing the same infostealer core. One March 2026 sample used a three-layer AutoIt v3 wrapper that dropped an intermediate file named `intersentimental` into `%TEMP%`, decrypted it with the recoverable 20-byte XOR key `WADEJD3GLJQWUK1CSRTG`, and launched shellcode to hollow legitimate Windows processes with a reused Formbook payload. The sample combined anti-analysis techniques including dead-code-heavy AutoIt scripting, custom string obfuscation, fake .NET CLR metadata, empty imports, API hashing, anti-debug checks, and Formbook’s RC4/SHA1-based self-decryption, while exposed build artifacts pointed to operator OPSEC failures such as a XAMPP-based build path, use of the default Windows Administrator account, clustered build times, and static XOR key reuse. A separate campaign delivered Formbook through a 38,000-line, 1.54 MB VBScript dropper that used WMI, PowerShell, steganography, and IPFS-hosted payloads to evade detection and resist takedown. The script launched a hidden PowerShell stage via `Win32_Process.Create`, fetched fake JPEG files from `gateway.lighthouse.storage`, extracted a reversed Base64-encoded .NET assembly hidden between custom markers, and invoked `Fiber.Program.Main` through reflection before creating a scheduled task and injecting the final payload into `wscript.exe`. Lure names such as `KIZAD_WSP-2025-PRO.vbs` suggest possible targeting of logistics, manufacturing, construction, or commercial organizations in the UAE or broader Gulf region.
Jun 29, 2026