Formbook uses localized order lures against European firms
Original title: Formbook Targets European Manufacturing and Technology Businesses with Localized Order Lures
ANY.RUN says JavaScript and PowerShell stages inject Formbook/XLoader to steal browser-stored credentials.
ANY.RUN describes a Formbook campaign, also known as XLoader, that uses localized order, procurement and payment lures against European businesses, especially manufacturing and technology firms in the UK and Italy. A sample archive titled Nova narudžba 0148-712.zip contains obfuscated JavaScript that launches PowerShell, decrypts a payload in memory and uses a .NET injector. The injector runs Formbook via aspnet_compiler.exe, with a watchdog that can reinject it, and the malware targets browser credential stores.
Unconfirmed: The infection chain and targeting claims come from ANY.RUN's sandbox investigation.
- Sandbox submissions of the archive began October 7, 2026; it appeared as an email attachment on October 23.
- Related lures use price lists, quotations, procurement requests and bank-transfer themes.
- Persistence uses scheduled startup mechanisms, according to ANY.RUN.
- HTTP traffic with an Android User-Agent from a Windows host is cited as a detection clue.
Impact: Theft of browser-stored credentials from infected workstations
- 1.Treat unexpected order and procurement attachments, including JavaScript in ZIP files, as malicious.
- 2.Reset credentials stored in browsers on hosts that opened the described lures.
- ATT&CK
- T1566.001 Spearphishing AttachmentT1059.007 JavaScriptT1059.001 PowerShellT1055.012 Process HollowingT1555.003 Credentials from Web Browsers
- Organizations
- ANY.RUN
- Countries
- United KingdomItaly
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | www.hlushkova.top | s identified two domains involved in the observed activity: www[.]hlushkova[.]top www[.]stanbicfinanceug[.]com Formbook’s communication w |
| domain | www.stanbicfinanceug.com | ns involved in the observed activity: www[.]hlushkova[.]top www[.]stanbicfinanceug[.]com Formbook’s communication with its C2 infrastructure The |
| sha256 | 58eb890b612938867237c3fa1715b8742d9b25a8fe136cd75ea659882b7b7a10 | le hashes (SHA-256) File SHA-256 Nova narudžba 0148-712.zip 58eb890b612938867237c3fa1715b8742d9b25a8fe136cd75ea659882b7b7a10 Nova narudžba 0148-712.js a970e997093fcd10d108354423c8fa420 |
| sha256 | a970e997093fcd10d108354423c8fa420a6887ed97cbf7c7dbe3551faa4d9b95 | 42d9b25a8fe136cd75ea659882b7b7a10 Nova narudžba 0148-712.js a970e997093fcd10d108354423c8fa420a6887ed97cbf7c7dbe3551faa4d9b95 AES PowerShell… |
From the original article
11 min read at any.run
European businesses, particularly in the UK and Italy, face malware campaigns that exploit routine business correspondence. A recent Formbook (now also known as XLoader) campaign uses localized order and procurement lures to deliver an information stealer. Manufacturing and technology companies are especially exposed because employees regularly handle purchase orders, supplier documents, and payment requests.
any.run
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.