XLoader

First seen

2016-01-01 00:00:00

Malware type

credential-stealer, keylogger, spyware, trojan

Family

Malware family

Operating systems

windows

Related IoCs

19842 (18060 malicious)

Last IoC activity

2026-10-17 04:28:56

Profile updated

2026-07-07 14:38:01

Targeted industries: financial-services government-and-public-sector healthcare-and-pharmaceutical retail-and-hospitality technology-and-telecommunications

Context

XLoader is an infostealer malware in use since at least 2016. Previously known and sometimes still referred to as Formbook, XLoader is a Malware as a Service (MaaS) known for stealing data from web browsers, email clients and File Transfer Protocol (FTP) applications.

Recent IoC activity

18,066 malicious indicators in Maltiverse are attributed to XLoader (S1207). The 20 most recently updated:

Detection coverage

• 7 YARA rules
• 439 Sigma rules

Malware & tools used

• Screen Capture (attack-pattern)
• Credentials from Password Stores (attack-pattern)
• Process Hollowing (attack-pattern)
• Disable or Modify Tools (attack-pattern)
• Steal Web Session Cookie (attack-pattern)
• Encrypted/Encoded File (attack-pattern)
• Scheduled Task (attack-pattern)
• AutoHotKey & AutoIT (attack-pattern)
• Keylogging (attack-pattern)
• File Deletion (attack-pattern)
• Exploitation for Client Execution (attack-pattern)
• Virtualization/Sandbox Evasion (attack-pattern)
• Clipboard Data (attack-pattern)
• Native API (attack-pattern)
• Credentials from Web Browsers (attack-pattern)
• Spearphishing Attachment (attack-pattern)
• Browser Session Hijacking (attack-pattern)
• System Shutdown/Reboot (attack-pattern)
• Debugger Evasion (attack-pattern)
• Deobfuscate/Decode Files or Information (attack-pattern)
• System Checks (attack-pattern)
• Web Protocols (attack-pattern)
• Asynchronous Procedure Call (attack-pattern)
• System Owner/User Discovery (attack-pattern)
• System Information Discovery (attack-pattern)

Detection rules

• CAPE_Formbook (yara-rule)
• MALPEDIA_Win_Formbook_Auto (yara-rule)
• CAPE_Formhooka (yara-rule)
• CAPE_Formconfa (yara-rule)
• CAPE_Formhelper (yara-rule)
• CAPE_Formconfb (yara-rule)
• SECUINFRA_MALWARE_Formbook_Filename_Stage_2 (yara-rule)

Reports & references

• any.run — Xloader Formbook Encryption Analysis And Malware Decryption (report)
• MITRE ATT&CK — S1207 (report)
• cloud.google.com — Formbook Malware Distribution Campaigns (report)
• acronis.com — Trojan As A Service From Formbook To Xloader (report)
• malpedia.caad.fkie.fraunhofer.de — Osx.Xloader (report)
• blog.malwarebytes.com — Osx Xloader Hides Little Except Its Main Purpose What We Learned In The Installation Process (report)
• lac.co.jp — 20220307 002893 (report)
• sentinelone.com — Detecting Xloader A Macos Malware As A Service Info Stealer And Keylogger (report)
• zscaler.com — Technical Analysis Xloader Versions 6 And 7 Part 1 (report)
• blogs.blackberry.com — Threat Thursday Xloader Infostealer (report)
• vmray.com — Malware Analysis Spotlight Xbinder Xloader (report)
• sublime.security — Xloader Deep Dive Link Based Malware Delivery Via Sharepoint Impersonation (report)
• medium.com — Layers Of Deception Analyzing The Complex Stages Of Xloader 4 3 Malware Evolution 2Dcb550B98D9 (report)
• zscaler.com — Analysis Xloaders C2 Network Encryption (report)
• research.checkpoint.com — Time Proven Tricks In A New Environment The Macos Evolution Of Formbook (report)
• sentinelone.com — Xloaders Latest Trick New Macos Variant Disguised As Signed Officenote App (report)
• research.checkpoint.com — Xloader Botnet Find Me If You Can (report)
• twitter.com — 1319463908952969216 (report)
• zscaler.com — Technical Analysis Xloader Versions 6 And 7 Part 2 (report)
• cip.gov.ua — Khto Stoyit Za Kiberatakami Na Ukrayinsku Kritichnu Informaciinu Infrastrukturu Statistika 15 22 Bereznya (report)
• research.checkpoint.com — Top Prevalent Malware With A Thousand Campaigns Migrates To Macos (report)
• malwarebookreports.com — Cross Platform Java Dropper Snake And Xloader Mac Version (report)

External references

• mitre-attack — S1207
• Formbook
• Acronis XLoader 2021
• CheckPoint XLoader 2022
• ANY.RUN XLoader 2023
• Google XLoader 2017
• Zscaler XLoader 2025
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy