XLoader password stealer hidden in fake business order emails
MALWAREXLoaderredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
Attackers are sending XLoader, a FormBook-family information stealer sold as a service, in Greek and Slovenian business-themed emails with RAR archives that contain obfuscated JScript. Morphisec reports that the chain runs largely in memory through a LuaJIT loader, hides inside a 32-bit Windows program, and tries to blind AMSI and ntdll event tracing. The same campaign also delivered Agent Tesla, Remcos and XWorm.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Block JavaScript files inside RAR and ZIP attachments at the mail gateway.
- Treat archives containing script files as suspicious, even when they reference a real-looking order number.
- Fully reset browser and email passwords on any machine that may be infected.
- Patch old Office flaws such as the Equation Editor vulnerability.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Cyber Security News