Loading story…
Researchers documented multiple XLoader/Formbook delivery chains that used different initial access methods but converged on the same information-stealing malware. One campaign used spam emails with PDF attachments that led victims through embedded XLSX and downloaded RTF files, while another impersonated SharePoint to push users to a malicious ZIP archive. A separate Excel-based campaign exploited CVE-2017-11882 in Microsoft Equation Editor (EQNEDT32.exe) through a malicious OLE object, triggering shellcode that downloaded and launched additional malware from attacker-controlled infrastructure.
Across the campaigns, the loaders relied on layered obfuscation, in-memory execution, and repeated process injection before deploying the final XLoader payload. Analysts observed AutoIT-based loaders, anti-analysis delays, CRC32 API hashing, shellcode injection into processes including svchost.exe, netsh.exe, and explorer.exe, and payload components hidden in bitmap resources and unpacked with steganography or decompression routines. The final malware established persistence through HKCU Run keys and shortcut artifacts, used process hollowing, and stole credentials, cookies, keystrokes, clipboard contents, and screenshots while maintaining command-and-control channels that could fetch additional payloads or remove the malware.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
Sublime analyzed and blocked a phishing email impersonating SharePoint that linked to a ZIP archive containing an AutoIT executable. The researchers assessed with high confidence that the final payload was XLoader/Formbook and with moderate confidence that the initial loader components were related to TrickGate, based on shellcode behavior, API hashing, staged injection, and PKT2-related C2 strings.
FortiGuard Labs reported a malicious Excel file, "GAT412-IFF22.xlsx," that auto-loaded an embedded OLE object and exploited CVE-2017-11882 in EQNEDT32.EXE to download and run a payload from lutanedukasi[.]co[.]id. The report also described a related Delphi-based Formbook loader that used a bitmap resource, Discord CDN payload retrieval, process hollowing, and Run-key persistence.
Cyble Research Labs analyzed a spam-driven infection chain in which a malicious PDF dropped an XLSX file that fetched an RTF exploiting CVE-2017-11882 to deliver Xloader. The report detailed the .NET loader stages, steganography in a bitmap resource, process hollowing, persistence, and Xloader's credential theft and C2 capabilities.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 117 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
sublime.security
Open sourcefortinet.com
Open sourceblog.cyble.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed how **XLoader**, the successor to **FormBook**, has evolved from a credential-stealing crimeware kit into a **malware-as-a-service** operation that rents command-and-control infrastructure while preserving FormBook’s core capabilities, including form grabbing, keylogging, screenshot capture, and theft of stored application credentials. Recent technical analysis shows XLoader remains active on **Windows and macOS** and now relies on heavier anti-analysis protections, including encrypted `PUSHEBP` blocks, custom virtual-machine logic, layered string and configuration encryption, decoy C2 domains, and multi-stage use of **RC4**, **XOR**, **Base64**, and modified hashing routines to conceal its real network infrastructure and internal configuration. The malware has continued to appear in varied delivery campaigns, including malicious spreadsheets that abuse the Office password **"VelvetSweatshop"** to auto-decrypt embedded content and fetch payloads, as well as email lures carrying compressed **VBS** attachments that establish persistence, download additional stages with PowerShell, and inject the final infostealer into legitimate processes such as `calc.exe` and `explorer.exe`. Earlier FormBook campaigns also targeted victims in the **U.S. and South Korea**, underscoring the family’s long-running operational use, while newer XLoader versions add further protocol changes such as a `PKT2` registration layer and even exhibit a coding flaw that can suppress transmission of host details including version, operating system, and username during C2 registration.
Aug 15, 2026
Threat researchers reported that attackers increasingly used malicious Microsoft Excel add-in files with the `.xll` extension as an initial access vector, exploiting Excel's `xlAutoOpen` behavior to run code with a single user action. HP Wolf Security said the technique was being used to deliver malware including **Dridex**, **Agent Tesla**, **Raccoon Stealer**, and **Formbook**, and noted that some samples were built with the legitimate **Excel-DNA** framework while others were custom downloaders that decrypted embedded configuration data, resolved APIs dynamically, fetched payloads, and executed them. Researchers also observed underground promotion of XLL dropper builders, indicating the method was becoming commoditized. Fortinet and SANS documented active spam operations using the format in the wild. One campaign used DHL and Amazon-themed lures to distribute a signed malicious XLL that downloaded `csrsc.exe` from `dmequest[.]com`, saved it as `%PUBLIC%\srtherhaeth[.]eXe`, and installed a Rust-based **Buer Loader** variant that communicated with `shipmentofficedepot[.]com`; the file was signed with a certificate assigned to **HORUM**, likely to reduce detection. Separately, SANS observed a **Hancitor** malspam wave using DocuSign-themed emails and Google `feedproxy` links that redirected victims through compromised sites to an XLL payload, which then retrieved an HTA file and a Hancitor executable from `srand04rf[.]ru`, followed by activity linked to **Cobalt Strike** and **Ficker Stealer**. Defenders were advised to block inbound XLL attachments, restrict add-ins to trusted signed files, or disable proprietary Excel add-ins where possible.
Aug 15, 2026
Threat actors are increasingly leveraging weaponized document formats and add-ins to compromise Windows users, with recent campaigns targeting organizations in multiple countries. One operation uncovered by researchers used phishing emails with RAR archives containing obfuscated JavaScript payloads, which exploited the CVE-2017-11882 vulnerability in Microsoft Office's Equation Editor. The infection chain included the use of malicious SVG files, ZIP archives with LNK shortcuts, and a sophisticated four-stage execution pipeline involving steganographically embedded .NET assemblies and the abuse of legitimate open-source libraries, all designed to evade detection and deliver commodity loaders for Remote Access Trojans and information stealers. Separately, attackers have been abusing Microsoft Excel's XLL add-in format to deliver malware, with a notable increase in such activity since 2021. Recent incidents include the submission of malicious XLL files to VirusTotal from Ukraine and Russia, which contained a backdoor named EchoGather capable of system reconnaissance, command execution, and file transfer. These XLL-based attacks often use open-source frameworks like Excel-DNA to facilitate payload delivery and in-memory execution, further complicating detection and mitigation efforts for targeted organizations.
Jun 29, 2026