XLoader
MITRE ATT&CK: S1207 View on attack.mitre.org
Aliases: Formbook, XLoader
- First seen
- 2016-01-01 00:00:00
- Malware type
- credential-stealer, keylogger, spyware, trojan
- Family
- Malware family
- Operating systems
- windows
- Related IoCs
- 16688 (15631 malicious)
- Last IoC activity
- 2026-09-02 04:23:16
- Profile updated
- 2026-07-07 14:38:01
Targeted industries: financial-services government-and-public-sector healthcare-and-pharmaceutical retail-and-hospitality technology-and-telecommunications
Context
XLoader is an infostealer malware in use since at least 2016. Previously known and sometimes still referred to as Formbook, XLoader is a Malware as a Service (MaaS) known for stealing data from web browsers, email clients and File Transfer Protocol (FTP) applications.
Recent IoC activity
15,676 malicious indicators in Maltiverse are attributed to XLoader (S1207). The 20 most recently updated:
Detection coverage
- 7 YARA rules
- 439 Sigma rules
Malware & tools used
- Screen Capture (attack-pattern)
- Credentials from Password Stores (attack-pattern)
- Process Hollowing (attack-pattern)
- Disable or Modify Tools (attack-pattern)
- Steal Web Session Cookie (attack-pattern)
- Encrypted/Encoded File (attack-pattern)
- Scheduled Task (attack-pattern)
- AutoHotKey & AutoIT (attack-pattern)
- Keylogging (attack-pattern)
- File Deletion (attack-pattern)
- Exploitation for Client Execution (attack-pattern)
- Virtualization/Sandbox Evasion (attack-pattern)
- Clipboard Data (attack-pattern)
- Native API (attack-pattern)
- Credentials from Web Browsers (attack-pattern)
- Spearphishing Attachment (attack-pattern)
- Browser Session Hijacking (attack-pattern)
- System Shutdown/Reboot (attack-pattern)
- Debugger Evasion (attack-pattern)
- Deobfuscate/Decode Files or Information (attack-pattern)
- System Checks (attack-pattern)
- Web Protocols (attack-pattern)
- Asynchronous Procedure Call (attack-pattern)
- System Owner/User Discovery (attack-pattern)
- System Information Discovery (attack-pattern)
Detection rules
- SECUINFRA_MALWARE_Formbook_Filename_Stage_2 (yara-rule)
- CAPE_Formhooka (yara-rule)
- CAPE_Formconfa (yara-rule)
- CAPE_Formhelper (yara-rule)
- CAPE_Formconfb (yara-rule)
- CAPE_Formbook (yara-rule)
- MALPEDIA_Win_Formbook_Auto (yara-rule)
Reports & references
- malpedia.caad.fkie.fraunhofer.de — Osx.Xloader (report)
- blog.malwarebytes.com — Osx Xloader Hides Little Except Its Main Purpose What We Learned In The Installation Process (report)
- lac.co.jp — 20220307 002893 (report)
- sentinelone.com — Detecting Xloader A Macos Malware As A Service Info Stealer And Keylogger (report)
- zscaler.com — Technical Analysis Xloader Versions 6 And 7 Part 1 (report)
- blogs.blackberry.com — Threat Thursday Xloader Infostealer (report)
- vmray.com — Malware Analysis Spotlight Xbinder Xloader (report)
- sublime.security — Xloader Deep Dive Link Based Malware Delivery Via Sharepoint Impersonation (report)
- medium.com — Layers Of Deception Analyzing The Complex Stages Of Xloader 4 3 Malware Evolution 2Dcb550B98D9 (report)
- zscaler.com — Analysis Xloaders C2 Network Encryption (report)
- research.checkpoint.com — Time Proven Tricks In A New Environment The Macos Evolution Of Formbook (report)
- sentinelone.com — Xloaders Latest Trick New Macos Variant Disguised As Signed Officenote App (report)
- research.checkpoint.com — Xloader Botnet Find Me If You Can (report)
- twitter.com — 1319463908952969216 (report)
- zscaler.com — Technical Analysis Xloader Versions 6 And 7 Part 2 (report)
- cip.gov.ua — Khto Stoyit Za Kiberatakami Na Ukrayinsku Kritichnu Informaciinu Infrastrukturu Statistika 15 22 Bereznya (report)
- research.checkpoint.com — Top Prevalent Malware With A Thousand Campaigns Migrates To Macos (report)
- malwarebookreports.com — Cross Platform Java Dropper Snake And Xloader Mac Version (report)
- any.run — Xloader Formbook Encryption Analysis And Malware Decryption (report)
- MITRE ATT&CK — S1207 (report)
- cloud.google.com — Formbook Malware Distribution Campaigns (report)
- acronis.com — Trojan As A Service From Formbook To Xloader (report)