XLoader
- Also known as
- Formbook
Latest
XLoader campaign hides credential stealer using LuaJIT and Windows process injection
A new XLoader infection chain hides the credential stealer inside an embedded LuaJIT interpreter, then moves it into another Windows process using shared-section injection. The campaign uses business-themed lures, including order and payment emails, with one Greek-language message noted. It has also been used to deliver Agent Tesla, Remcos and XWorm.
XLoader password stealer hidden in fake business order emails
Attackers are sending XLoader, a FormBook-family information stealer sold as a service, in Greek and Slovenian business-themed emails with RAR archives that contain obfuscated JScript. Morphisec reports that the chain runs largely in memory through a LuaJIT loader, hides inside a 32-bit Windows program, and tries to blind AMSI and ntdll event tracing. The same campaign also delivered Agent Tesla, Remcos and XWorm.