Loading story…
Research into Microsoft InfoPath .xsn form templates found manifest-level modifications that can facilitate phishing, payload delivery, and potential code execution. Changing a form's managed-code setting from enabled="yes" to enabled="no" reportedly allowed managed code to run without displaying the normal user warning dialog, reducing a key user-facing safeguard.
The researcher also found that removing the publishUrl from a Domain-level template could allow script-containing forms to open outside their intended publication location. Custom taskpane manifest entries could be redirected to embedded non-HTML content, custom URIs, scripts, HTA files, or executables; because InfoPath taskpanes retain an Internet Explorer-based rendering engine, organizations using InfoPath 2013 with Office 365 ProPlus should treat untrusted .xsn files as potentially malicious and restrict their use.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
A researcher reported that modifying InfoPath .xsn manifest settings could suppress managed-code warnings, bypass Domain-level publication-location restrictions for certain scripted forms, and make custom taskpanes load non-HTML embedded resources or executables.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
microsoft.com
Open sourcespaceraccoon.dev
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft's patched `CVE-2026-65660` vulnerability in on-premises SharePoint Server enables authenticated, low-privileged users to execute arbitrary code remotely. The flaw affects SharePoint Server 2016, 2019, and Subscription Edition: attackers can inject `Register` directives into ToolPane web-part markup, bypass SafeControls validation, load arbitrary .NET classes, and trigger deserialization via `XamlServices.Parse()`. Microsoft initially categorized the issue as authenticated spoofing with a CVSS score of 6.5, while the NVD rates it 8.8 and a separate Microsoft record identifies it as RCE. Updates released August 11 disable the vulnerable function by default; organizations should apply them promptly, particularly because public exploit material includes an in-memory webshell payload. No active exploitation has been reported and CISA has not listed the CVE as known exploited, but unsupported SharePoint 2013 may remain exposed to the underlying technique.
Sep 28, 2026
Researchers documented multiple **XLoader/Formbook** delivery chains that used different initial access methods but converged on the same information-stealing malware. One campaign used spam emails with PDF attachments that led victims through embedded `XLSX` and downloaded `RTF` files, while another impersonated **SharePoint** to push users to a malicious ZIP archive. A separate Excel-based campaign exploited **`CVE-2017-11882`** in Microsoft Equation Editor (`EQNEDT32.exe`) through a malicious OLE object, triggering shellcode that downloaded and launched additional malware from attacker-controlled infrastructure. Across the campaigns, the loaders relied on layered obfuscation, in-memory execution, and repeated process injection before deploying the final **XLoader** payload. Analysts observed AutoIT-based loaders, anti-analysis delays, CRC32 API hashing, shellcode injection into processes including `svchost.exe`, `netsh.exe`, and `explorer.exe`, and payload components hidden in bitmap resources and unpacked with steganography or decompression routines. The final malware established persistence through **HKCU Run** keys and shortcut artifacts, used process hollowing, and stole credentials, cookies, keystrokes, clipboard contents, and screenshots while maintaining command-and-control channels that could fetch additional payloads or remove the malware.
Aug 15, 2026
Researchers reported that Windows Provisioning Package files (`.ppkg`) can be weaponized to execute arbitrary commands while appearing to be legitimate deployment artifacts used for device setup and configuration. The packages, typically created with Windows Configuration Designer in the Windows ADK, can contain scripts, installers, account settings, network configuration, and other customization data; the research also noted that sensitive values, including commands and credentials, may be stored in clear text in `customizations.xml`. The demonstrated attack requires elevated privileges and user interaction, including a User Account Control prompt and a second confirmation step, making social engineering or prior access important to successful abuse. Defenders were advised to monitor the **Microsoft-Windows-Provisioning-Diagnostics-Provider** log, particularly Event IDs **10** and **20**, along with Windows auditing events **4657** and **4663**, and to review forensic artifacts in `C:\ProgramData\Microsoft\Provisioning` and `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Provisioning\Results`; the runtime process `provtool.exe` was identified as central to package execution and investigation.
Aug 14, 2026