Phishing Word documents deliver XLoader 8.9 via CVE-2017-11882

ASEC says purchase-order Word attachments exploit CVE-2017-11882 and run XLoader 8.9 in memory on Windows.

ASEC reported on November 12 that phishing emails posed as purchase-order confirmations attach malicious Word documents aimed at Windows systems. The DOCX loads an embedded RTF through Word’s altChunk feature, and an Equation Editor object exploits CVE-2017-11882 to run a dropped Visual Basic script without a macro prompt. PowerShell stores staged content in the registry, sets a current-user Run entry, XOR-decrypts a payload, and executes XLoader in memory. ASEC says the sample is XLoader 8.9, which steals computer and browser data and can download more malware. No actor, recipient count, or infection total is given. ASEC links the chain to similar purchase-confirmation lures from April 2025 but does not tie the activity to one operator.