XLoader password stealer hidden in fake business order emails
- Severity
- High
- Sources
- 1
What happened
XLoader (FormBook family) is delivered through RE:-subject order and quotation lures with RAR archives holding obfuscated JScript run by Windows Script Host. The script drops a LuaJIT interpreter and Lua loader into Documents, attempts to patch AMSI and 12 ntdll functions, then injects the payload via a shared memory section and thread context change into hosts such as cleanmgr.exe, clip.exe or mshta.exe, avoiding process hollowing and WriteProcessMemory. No CVE is cited for this chain. Block JS in archives, hunt for random-named LuaJIT binaries in Documents, check for scheduled task EHFTUOMQDRXVTJSF, and reset credentials on any infected host.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Block JavaScript files inside RAR and ZIP attachments at the mail gateway.
- Treat archives containing script files as suspicious, even when they reference a real-looking order number.
- Fully reset browser and email passwords on any machine that may be infected.
- Patch old Office flaws such as the Equation Editor vulnerability.
Written by AI from the sources, checked against them