LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S1207: XLoader

XLoader is an infostealer malware in use since at least 2016. Previously known and sometimes still referred to as Formbook, XLoader is a Malware as a Service (MaaS) known for stealing data from web browsers, email clients and File Transfer Protocol (FTP) applications.[1][2][3][4][5]

EnterpriseS1207MalwareObject v1.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

XLoader is a Windows infostealer, also known historically as Formbook, described by ATT&CK as Malware-as-a-Service in use since at least 2016. Its business significance is credential and session exposure: ATT&CK links it to stealing from browsers, email clients, FTP applications, password stores, web session cookies, keylogging, clipboard collection, and screen capture. For leaders, this is less about one malware name and more about whether the organization can quickly prove which identities, browser sessions, and application credentials may be exposed after a Windows endpoint compromise.

Executive priority

Prioritize XLoader-relevant readiness where endpoint compromise could become identity, SaaS, email, or FTP compromise. Executives should ask whether SOC and IR teams can rapidly answer: which user was affected, what credentials or cookies were accessible, whether persistence was created through scheduled tasks or Run keys, whether outbound web-protocol command-and-control occurred, and what password/session reset actions are required. Because ATT&CK provides no official detection guidance for this object, coverage should be validated through telemetry and response playbooks rather than assumed from malware naming alone.

Technical view

ATT&CK lists XLoader on Windows and relates it to obfuscation, packing, encrypted or encoded files, deobfuscation, sandbox evasion, discovery, persistence via Scheduled Task and Registry Run Keys/Startup Folder, process injection via APC injection and Process Hollowing, execution through Native API and AutoHotKey/AutoIT, collection through keylogging, clipboard data, screen capture, browser session hijacking, credential theft from password stores and web browsers, web session cookie theft, web-protocol C2, file deletion, exploitation for client execution, and system shutdown/reboot. SOC and IR teams should validate behavior-based detection and triage around these relationships, especially where endpoint, identity, browser, and network evidence can be correlated to a single Windows user session.

Likely telemetry

  • Windows endpoint process creation and command-line telemetry, including scripting and automation activity such as AutoHotKey or AutoIT where present
  • Windows scheduled task creation or modification events
  • Registry Run key and Startup Folder modification events
  • Endpoint memory/process telemetry capable of surfacing process injection patterns such as APC injection or process hollowing
  • File creation, deletion, packing/obfuscation indicators, and encoded or encrypted payload artifacts

Detection direction

  • Do not depend only on static signatures; ATT&CK relationships include packing, encoded/encrypted files, deobfuscation, and sandbox evasion, which can reduce simple file-based confidence.
  • Correlate persistence signals, especially Scheduled Task and Registry Run Key or Startup Folder changes, with unusual parent processes, newly written binaries, or user-context execution.
  • Tune for process injection behavior on Windows, including suspicious suspended-process creation, memory manipulation, and execution in another process context, while accounting for legitimate security and administration tools that may produce similar low-level signals.
  • Treat browser credential store access, web session cookie access, keylogging, clipboard capture, and screen capture as high-value collection behaviors when they occur outside normal application patterns.
  • Review outbound web-protocol traffic from suspicious processes rather than only from browsers, because the related command-and-control behavior uses web protocols that can blend into normal traffic.

Mitigation priorities

  • Prioritize endpoint hardening and monitoring on Windows systems that handle email, browser-based business applications, FTP workflows, or stored credentials.
  • Reduce credential exposure by limiting saved browser passwords where policy allows, strengthening credential management, and ensuring rapid password and session invalidation procedures are available after suspected infostealer activity.
  • Harden persistence paths by monitoring and controlling Scheduled Tasks, Registry Run keys, and Startup Folder execution, with change review for unusual user-context autoruns.
  • Maintain client application patching discipline because ATT&CK relates XLoader to exploitation for client execution; vulnerability management should focus on software exposed to user-delivered content.
  • Ensure EDR or equivalent endpoint controls can capture process, registry, file, memory, and network context needed for behavior-based triage, especially for obfuscation and injection-related activity.
Additional notes and limits

The supplied ATT&CK object identifies XLoader as a Windows infostealer and Malware-as-a-Service, previously known as Formbook, with relationships to numerous ATT&CK techniques. The strongest defensive value is using those relationships to test whether endpoint, network, browser, and identity teams can jointly scope credential and session theft from a Windows host. The object itself has tactics listed as not specified, so tactic framing here is derived from the related techniques rather than the malware object’s tactic field.

ATT&CK provides no official detection text for S1207 in the supplied fields. The relationship list supports likely behavior areas but does not prove every observed sample or incident will use every technique. Local telemetry, software inventory, identity architecture, browser policy, and incident evidence are required to determine actual exposure and response actions.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

XLoader

XLoader is an infostealer malware in use since at least 2016. Previously known and sometimes still referred to as Formbook, XLoader is a Malware as a Service (MaaS) known for stealing data from web browsers, email clients and File Transfer Protocol (FTP) applications.[1][2][3][4][5]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

28 rows
DomainIDNameRelationship / procedure
EnterpriseT1113Screen Capture

XLoader can capture screenshots on compromised hosts.[5][6]

EnterpriseT1555Credentials from Password Stores

XLoader can collect credentials stored in email clients.[5][6]

EnterpriseT1055.012Process HollowingSub-technique

XLoader uses process hollowing by injecting itself into the `explorer.exe` process and other files ithin the Windows `SysWOW64` directory.[1][5][2]

EnterpriseT1685Disable or Modify Tools

XLoader loads a copy of NTDLL to evade hooks from security monitoring tools on this library.[1] XLoader can add the path of its executable to the Microsoft Defender exclusion list.[6]

EnterpriseT1539Steal Web Session Cookie

XLoader can capture web session cookies and session information from victim browsers.[5]

EnterpriseT1027.013Encrypted/Encoded FileSub-technique

XLoader features encrypted functions using the RC4 algorithm and bytecode operations.[1][2]

EnterpriseT1053.005Scheduled TaskSub-technique

XLoader can create scheduled tasks for persistence.[6]

EnterpriseT1059.010AutoHotKey & AutoITSub-technique

XLoader can use an AutoIT script to decrypt a payload file, load it into victim memory, then execute it on the victim machine.[5]

EnterpriseT1056.001KeyloggingSub-technique

XLoader can capture keystrokes from the victim machine.[5]

EnterpriseT1070.004File DeletionSub-technique

XLoader can delete malicious executables from compromised machines.[4]

EnterpriseT1203Exploitation for Client Execution

XLoader has exploited Office vulnerabilities during local execution such as CVE-2017-11882 and CVE-2018-0798.[6]

EnterpriseT1497Virtualization/Sandbox Evasion

XLoader can utilize decoy command and control domains within the malware configuration to circumvent sandbox analysis.[2][3]

EnterpriseT1115Clipboard Data

XLoader can collect data stored in the victim's clipboard.[5][6]

EnterpriseT1106Native API

XLoader uses the native Windows API for functionality, including defense evasion.[1]

EnterpriseT1555.003Credentials from Web BrowsersSub-technique

XLoader can gather credentials from several web browsers.[1][5][6]

EnterpriseT1566.001Spearphishing AttachmentSub-technique

XLoader has been delivered as a phishing attachment, including PDFs with embedded links, Word and Excel files, and various archive files (ZIP, RAR, ACE, and ISOs) containing EXE payloads.[5][4]

EnterpriseT1185Browser Session Hijacking

XLoader can conduct form grabbing, steal cookies, and extract data from HTTP sessions.[5]

EnterpriseT1529System Shutdown/Reboot

XLoader can initiate a system reboot or shutdown.[5]

EnterpriseT1622Debugger Evasion

XLoader uses anti-debugging mechanisms such as calling `NtQueryInformationProcess` with `InfoClass=7`, referencing `ProcessDebugPort`, to determine if it is being analyzed.[5]

EnterpriseT1140Deobfuscate/Decode Files or Information

XLoader uses XOR and RC4 algorithms to decrypt payloads and functions.[1] XLoader can be distributed as a self-extracting RAR archive that launches an AutoIT loader.[5]

EnterpriseT1497.001System ChecksSub-technique

XLoader performs timing checks using the Read-Time Stamp Counter (RDTSC) instruction on the victim CPU.[5]

EnterpriseT1071.001Web ProtocolsSub-technique

XLoader uses HTTP and HTTPS for command and control communication.[5]

EnterpriseT1055.004Asynchronous Procedure CallSub-technique

XLoader injects code into the APC queue using `NtQueueApcThread` API.[1]

EnterpriseT1033System Owner/User Discovery

XLoader can identify the username from a victim machine.[4]

EnterpriseT1082System Information Discovery

XLoader can collect system information and supported language information from the victim machine.[4]

EnterpriseT1583.001DomainsSub-technique

XLoader can utilize hardcoded command and control domain configurations created by the XLoader authors. These are designed to mimic domain registrars and hosting service providers such as Hostinger and Namecheap.[3]

EnterpriseT1027.002Software PackingSub-technique

XLoader uses various packers, including CyaX, to obfuscate malicious executables.[6]

EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

XLoader establishes persistence by copying its executable in a subdirectory of `%APPDATA%` or `%PROGRAMFILES%`, and then modifies Windows Registry Run keys or policies keys to execute the executable on system start.[1][5]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1113: Screen CaptureEnterpriseuses · TechniqueT1555: Credentials from Password StoresEnterpriseuses · TechniqueT1055.012: Process HollowingEnterpriseuses · TechniqueT1685: Disable or Modify ToolsEnterpriseuses · TechniqueT1539: Steal Web Session CookieEnterpriseuses · TechniqueT1027.013: Encrypted/Encoded FileEnterpriseuses · TechniqueT1053.005: Scheduled TaskEnterpriseuses · TechniqueT1059.010: AutoHotKey & AutoITEnterpriseuses · TechniqueT1056.001: KeyloggingEnterpriseuses · TechniqueT1070.004: File DeletionEnterpriseuses · TechniqueT1203: Exploitation for Client ExecutionEnterpriseuses · TechniqueT1497: Virtualization/Sandbox EvasionEnterpriseuses · TechniqueT1115: Clipboard DataEnterpriseuses · TechniqueT1106: Native APIEnterpriseuses · TechniqueT1555.003: Credentials from Web BrowsersEnterpriseuses · TechniqueT1566.001: Spearphishing AttachmentEnterpriseuses · TechniqueT1185: Browser Session HijackingEnterpriseuses · TechniqueT1529: System Shutdown/RebootEnterpriseuses · TechniqueT1622: Debugger EvasionEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1497.001: System ChecksEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1055.004: Asynchronous Procedure CallEnterpriseuses · TechniqueT1033: System Owner/User DiscoveryEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.0
Created
Modified
Raw hash
ca66366f0ecd7f87...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.0Current bundleca66366f0ecd…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Zscaler XLoader 2025

    Zscaler Threatlabz. (2025, January 27). Technical Analysis of Xloader Versions 6 and 7 | Part 1. Retrieved March 11, 2025.

    Open source URL
  2. [2]
    ANY.RUN XLoader 2023

    ANY.RUN. (2023, February 28). XLoader/FormBook: Encryption Analysis and Malware Decryption . Retrieved March 11, 2025.

    Open source URL
  3. [3]
    CheckPoint XLoader 2022

    Alexey Bukhteyev & Raman Ladutska, Check Point Research. (2022, May 31). XLoader Botnet: Find Me If You Can. Retrieved March 11, 2025.

    Open source URL
  4. [4]
    Acronis XLoader 2021

    Acronis. (2021, November 26). Trojan-as-a-service: From Formbook to XLoader. Retrieved March 11, 2025.

    Open source URL
  5. [5]
    Google XLoader 2017

    Nart Villeneuve, Randi Eitzman, Sandor Nemes & Tyler Dean, Google Cloud. (2017, October 5). Significant FormBook Distribution Campaigns Impacting the U.S. and South Korea. Retrieved March 11, 2025.

    Open source URL
  6. [6]
    Netskope XLoader 2022

    Gustavo Palazolo, Netskope. (2022, March 11). New Formbook Campaign Delivered Through Phishing Emails. Retrieved March 11, 2025.

    Open source URL
  7. [7]
    ANY.RUN XLoader 2023

    ANY.RUN. (2023, February 28). XLoader/FormBook: Encryption Analysis and Malware Decryption . Retrieved March 11, 2025.

    Open source URL
  8. [8]
    ANY.RUN XLoader 2023

    ANY.RUN. (2023, February 28). XLoader/FormBook: Encryption Analysis and Malware Decryption . Retrieved March 11, 2025.

    Open source URL
  9. [9]
    Acronis XLoader 2021

    Acronis. (2021, November 26). Trojan-as-a-service: From Formbook to XLoader. Retrieved March 11, 2025.

    Open source URL
  10. [10]
    Acronis XLoader 2021

    Acronis. (2021, November 26). Trojan-as-a-service: From Formbook to XLoader. Retrieved March 11, 2025.

    Open source URL
  11. [11]
    CheckPoint XLoader 2022

    Alexey Bukhteyev & Raman Ladutska, Check Point Research. (2022, May 31). XLoader Botnet: Find Me If You Can. Retrieved March 11, 2025.

    Open source URL
  12. [12]
    CheckPoint XLoader 2022

    Alexey Bukhteyev & Raman Ladutska, Check Point Research. (2022, May 31). XLoader Botnet: Find Me If You Can. Retrieved March 11, 2025.

    Open source URL
  13. [13]
    Formbook

    (Citation: Zscaler XLoader 2025)(Citation: ANY.RUN XLoader 2023)(Citation: CheckPoint XLoader 2022)(Citation: Google XLoader 2017)

  14. [14]
    Formbook

    (Citation: Zscaler XLoader 2025)(Citation: ANY.RUN XLoader 2023)(Citation: CheckPoint XLoader 2022)(Citation: Google XLoader 2017)

  15. [15]
    Formbook

    (Citation: Zscaler XLoader 2025)(Citation: ANY.RUN XLoader 2023)(Citation: CheckPoint XLoader 2022)(Citation: Google XLoader 2017)

  16. [16]
    Google XLoader 2017

    Nart Villeneuve, Randi Eitzman, Sandor Nemes & Tyler Dean, Google Cloud. (2017, October 5). Significant FormBook Distribution Campaigns Impacting the U.S. and South Korea. Retrieved March 11, 2025.

    Open source URL
  17. [17]
    Google XLoader 2017

    Nart Villeneuve, Randi Eitzman, Sandor Nemes & Tyler Dean, Google Cloud. (2017, October 5). Significant FormBook Distribution Campaigns Impacting the U.S. and South Korea. Retrieved March 11, 2025.

    Open source URL
  18. [18]
    Zscaler XLoader 2025

    Zscaler Threatlabz. (2025, January 27). Technical Analysis of Xloader Versions 6 and 7 | Part 1. Retrieved March 11, 2025.

    Open source URL
  19. [19]
    Zscaler XLoader 2025

    Zscaler Threatlabz. (2025, January 27). Technical Analysis of Xloader Versions 6 and 7 | Part 1. Retrieved March 11, 2025.

    Open source URL
  20. [20]
    mitre-attackS1207
    Open source URL
  21. [21]
    mitre-attackS1207
    Open source URL
  22. [22]
    mitre-attackS1207
    Open source URL
  23. [23]
    Google XLoader 2017

    Nart Villeneuve, Randi Eitzman, Sandor Nemes & Tyler Dean, Google Cloud. (2017, October 5). Significant FormBook Distribution Campaigns Impacting the U.S. and South Korea. Retrieved March 11, 2025.

    Open source URL
  24. [24]
    Google XLoader 2017

    Nart Villeneuve, Randi Eitzman, Sandor Nemes & Tyler Dean, Google Cloud. (2017, October 5). Significant FormBook Distribution Campaigns Impacting the U.S. and South Korea. Retrieved March 11, 2025.

    Open source URL
  25. [25]
    Netskope XLoader 2022

    Gustavo Palazolo, Netskope. (2022, March 11). New Formbook Campaign Delivered Through Phishing Emails. Retrieved March 11, 2025.

    Open source URL
  26. [26]
    Google XLoader 2017

    Nart Villeneuve, Randi Eitzman, Sandor Nemes & Tyler Dean, Google Cloud. (2017, October 5). Significant FormBook Distribution Campaigns Impacting the U.S. and South Korea. Retrieved March 11, 2025.

    Open source URL
  27. [27]
    Google XLoader 2017

    Nart Villeneuve, Randi Eitzman, Sandor Nemes & Tyler Dean, Google Cloud. (2017, October 5). Significant FormBook Distribution Campaigns Impacting the U.S. and South Korea. Retrieved March 11, 2025.

    Open source URL
  28. [28]
    Netskope XLoader 2022

    Gustavo Palazolo, Netskope. (2022, March 11). New Formbook Campaign Delivered Through Phishing Emails. Retrieved March 11, 2025.

    Open source URL
  29. [29]
    Netskope XLoader 2022

    Gustavo Palazolo, Netskope. (2022, March 11). New Formbook Campaign Delivered Through Phishing Emails. Retrieved March 11, 2025.

    Open source URL
  30. [30]
    ANY.RUN XLoader 2023

    ANY.RUN. (2023, February 28). XLoader/FormBook: Encryption Analysis and Malware Decryption . Retrieved March 11, 2025.

    Open source URL
  31. [31]
    ANY.RUN XLoader 2023

    ANY.RUN. (2023, February 28). XLoader/FormBook: Encryption Analysis and Malware Decryption . Retrieved March 11, 2025.

    Open source URL
  32. [32]
    Google XLoader 2017

    Nart Villeneuve, Randi Eitzman, Sandor Nemes & Tyler Dean, Google Cloud. (2017, October 5). Significant FormBook Distribution Campaigns Impacting the U.S. and South Korea. Retrieved March 11, 2025.

    Open source URL
  33. [33]
    Google XLoader 2017

    Nart Villeneuve, Randi Eitzman, Sandor Nemes & Tyler Dean, Google Cloud. (2017, October 5). Significant FormBook Distribution Campaigns Impacting the U.S. and South Korea. Retrieved March 11, 2025.

    Open source URL
  34. [34]
    Zscaler XLoader 2025

    Zscaler Threatlabz. (2025, January 27). Technical Analysis of Xloader Versions 6 and 7 | Part 1. Retrieved March 11, 2025.

    Open source URL
  35. [35]
    Zscaler XLoader 2025

    Zscaler Threatlabz. (2025, January 27). Technical Analysis of Xloader Versions 6 and 7 | Part 1. Retrieved March 11, 2025.

    Open source URL
  36. [36]
    Netskope XLoader 2022

    Gustavo Palazolo, Netskope. (2022, March 11). New Formbook Campaign Delivered Through Phishing Emails. Retrieved March 11, 2025.

    Open source URL
  37. [37]
    Netskope XLoader 2022

    Gustavo Palazolo, Netskope. (2022, March 11). New Formbook Campaign Delivered Through Phishing Emails. Retrieved March 11, 2025.

    Open source URL
  38. [38]
    Zscaler XLoader 2025

    Zscaler Threatlabz. (2025, January 27). Technical Analysis of Xloader Versions 6 and 7 | Part 1. Retrieved March 11, 2025.

    Open source URL
  39. [39]
    Zscaler XLoader 2025

    Zscaler Threatlabz. (2025, January 27). Technical Analysis of Xloader Versions 6 and 7 | Part 1. Retrieved March 11, 2025.

    Open source URL
  40. [40]
    Google XLoader 2017

    Nart Villeneuve, Randi Eitzman, Sandor Nemes & Tyler Dean, Google Cloud. (2017, October 5). Significant FormBook Distribution Campaigns Impacting the U.S. and South Korea. Retrieved March 11, 2025.

    Open source URL
  41. [41]
    Google XLoader 2017

    Nart Villeneuve, Randi Eitzman, Sandor Nemes & Tyler Dean, Google Cloud. (2017, October 5). Significant FormBook Distribution Campaigns Impacting the U.S. and South Korea. Retrieved March 11, 2025.

    Open source URL
  42. [42]
    ANY.RUN XLoader 2023

    ANY.RUN. (2023, February 28). XLoader/FormBook: Encryption Analysis and Malware Decryption . Retrieved March 11, 2025.

    Open source URL
  43. [43]
    ANY.RUN XLoader 2023

    ANY.RUN. (2023, February 28). XLoader/FormBook: Encryption Analysis and Malware Decryption . Retrieved March 11, 2025.

    Open source URL
  44. [44]
    Zscaler XLoader 2025

    Zscaler Threatlabz. (2025, January 27). Technical Analysis of Xloader Versions 6 and 7 | Part 1. Retrieved March 11, 2025.

    Open source URL
  45. [45]
    Zscaler XLoader 2025

    Zscaler Threatlabz. (2025, January 27). Technical Analysis of Xloader Versions 6 and 7 | Part 1. Retrieved March 11, 2025.

    Open source URL
  46. [46]
    Netskope XLoader 2022

    Gustavo Palazolo, Netskope. (2022, March 11). New Formbook Campaign Delivered Through Phishing Emails. Retrieved March 11, 2025.

    Open source URL
  47. [47]
    Netskope XLoader 2022

    Gustavo Palazolo, Netskope. (2022, March 11). New Formbook Campaign Delivered Through Phishing Emails. Retrieved March 11, 2025.

    Open source URL
  48. [48]
    Google XLoader 2017

    Nart Villeneuve, Randi Eitzman, Sandor Nemes & Tyler Dean, Google Cloud. (2017, October 5). Significant FormBook Distribution Campaigns Impacting the U.S. and South Korea. Retrieved March 11, 2025.

    Open source URL
  49. [49]
    Google XLoader 2017

    Nart Villeneuve, Randi Eitzman, Sandor Nemes & Tyler Dean, Google Cloud. (2017, October 5). Significant FormBook Distribution Campaigns Impacting the U.S. and South Korea. Retrieved March 11, 2025.

    Open source URL
  50. [50]
    Google XLoader 2017

    Nart Villeneuve, Randi Eitzman, Sandor Nemes & Tyler Dean, Google Cloud. (2017, October 5). Significant FormBook Distribution Campaigns Impacting the U.S. and South Korea. Retrieved March 11, 2025.

    Open source URL
  51. [51]
    Google XLoader 2017

    Nart Villeneuve, Randi Eitzman, Sandor Nemes & Tyler Dean, Google Cloud. (2017, October 5). Significant FormBook Distribution Campaigns Impacting the U.S. and South Korea. Retrieved March 11, 2025.

    Open source URL
  52. [52]
    Acronis XLoader 2021

    Acronis. (2021, November 26). Trojan-as-a-service: From Formbook to XLoader. Retrieved March 11, 2025.

    Open source URL
  53. [53]
    Acronis XLoader 2021

    Acronis. (2021, November 26). Trojan-as-a-service: From Formbook to XLoader. Retrieved March 11, 2025.

    Open source URL
  54. [54]
    Netskope XLoader 2022

    Gustavo Palazolo, Netskope. (2022, March 11). New Formbook Campaign Delivered Through Phishing Emails. Retrieved March 11, 2025.

    Open source URL
  55. [55]
    Netskope XLoader 2022

    Gustavo Palazolo, Netskope. (2022, March 11). New Formbook Campaign Delivered Through Phishing Emails. Retrieved March 11, 2025.

    Open source URL
  56. [56]
    ANY.RUN XLoader 2023

    ANY.RUN. (2023, February 28). XLoader/FormBook: Encryption Analysis and Malware Decryption . Retrieved March 11, 2025.

    Open source URL
  57. [57]
    ANY.RUN XLoader 2023

    ANY.RUN. (2023, February 28). XLoader/FormBook: Encryption Analysis and Malware Decryption . Retrieved March 11, 2025.

    Open source URL
  58. [58]
    CheckPoint XLoader 2022

    Alexey Bukhteyev & Raman Ladutska, Check Point Research. (2022, May 31). XLoader Botnet: Find Me If You Can. Retrieved March 11, 2025.

    Open source URL
  59. [59]
    CheckPoint XLoader 2022

    Alexey Bukhteyev & Raman Ladutska, Check Point Research. (2022, May 31). XLoader Botnet: Find Me If You Can. Retrieved March 11, 2025.

    Open source URL
  60. [60]
    Google XLoader 2017

    Nart Villeneuve, Randi Eitzman, Sandor Nemes & Tyler Dean, Google Cloud. (2017, October 5). Significant FormBook Distribution Campaigns Impacting the U.S. and South Korea. Retrieved March 11, 2025.

    Open source URL
  61. [61]
    Google XLoader 2017

    Nart Villeneuve, Randi Eitzman, Sandor Nemes & Tyler Dean, Google Cloud. (2017, October 5). Significant FormBook Distribution Campaigns Impacting the U.S. and South Korea. Retrieved March 11, 2025.

    Open source URL
  62. [62]
    Netskope XLoader 2022

    Gustavo Palazolo, Netskope. (2022, March 11). New Formbook Campaign Delivered Through Phishing Emails. Retrieved March 11, 2025.

    Open source URL
  63. [63]
    Netskope XLoader 2022

    Gustavo Palazolo, Netskope. (2022, March 11). New Formbook Campaign Delivered Through Phishing Emails. Retrieved March 11, 2025.

    Open source URL
  64. [64]
    Zscaler XLoader 2025

    Zscaler Threatlabz. (2025, January 27). Technical Analysis of Xloader Versions 6 and 7 | Part 1. Retrieved March 11, 2025.

    Open source URL
  65. [65]
    Zscaler XLoader 2025

    Zscaler Threatlabz. (2025, January 27). Technical Analysis of Xloader Versions 6 and 7 | Part 1. Retrieved March 11, 2025.

    Open source URL
  66. [66]
    Google XLoader 2017

    Nart Villeneuve, Randi Eitzman, Sandor Nemes & Tyler Dean, Google Cloud. (2017, October 5). Significant FormBook Distribution Campaigns Impacting the U.S. and South Korea. Retrieved March 11, 2025.

    Open source URL
  67. [67]
    Google XLoader 2017

    Nart Villeneuve, Randi Eitzman, Sandor Nemes & Tyler Dean, Google Cloud. (2017, October 5). Significant FormBook Distribution Campaigns Impacting the U.S. and South Korea. Retrieved March 11, 2025.

    Open source URL
  68. [68]
    Netskope XLoader 2022

    Gustavo Palazolo, Netskope. (2022, March 11). New Formbook Campaign Delivered Through Phishing Emails. Retrieved March 11, 2025.

    Open source URL
  69. [69]
    Netskope XLoader 2022

    Gustavo Palazolo, Netskope. (2022, March 11). New Formbook Campaign Delivered Through Phishing Emails. Retrieved March 11, 2025.

    Open source URL
  70. [70]
    Zscaler XLoader 2025

    Zscaler Threatlabz. (2025, January 27). Technical Analysis of Xloader Versions 6 and 7 | Part 1. Retrieved March 11, 2025.

    Open source URL
  71. [71]
    Zscaler XLoader 2025

    Zscaler Threatlabz. (2025, January 27). Technical Analysis of Xloader Versions 6 and 7 | Part 1. Retrieved March 11, 2025.

    Open source URL
  72. [72]
    Acronis XLoader 2021

    Acronis. (2021, November 26). Trojan-as-a-service: From Formbook to XLoader. Retrieved March 11, 2025.

    Open source URL
  73. [73]
    Acronis XLoader 2021

    Acronis. (2021, November 26). Trojan-as-a-service: From Formbook to XLoader. Retrieved March 11, 2025.

    Open source URL
  74. [74]
    Google XLoader 2017

    Nart Villeneuve, Randi Eitzman, Sandor Nemes & Tyler Dean, Google Cloud. (2017, October 5). Significant FormBook Distribution Campaigns Impacting the U.S. and South Korea. Retrieved March 11, 2025.

    Open source URL
  75. [75]
    Google XLoader 2017

    Nart Villeneuve, Randi Eitzman, Sandor Nemes & Tyler Dean, Google Cloud. (2017, October 5). Significant FormBook Distribution Campaigns Impacting the U.S. and South Korea. Retrieved March 11, 2025.

    Open source URL
  76. [76]
    Google XLoader 2017

    Nart Villeneuve, Randi Eitzman, Sandor Nemes & Tyler Dean, Google Cloud. (2017, October 5). Significant FormBook Distribution Campaigns Impacting the U.S. and South Korea. Retrieved March 11, 2025.

    Open source URL
  77. [77]
    Google XLoader 2017

    Nart Villeneuve, Randi Eitzman, Sandor Nemes & Tyler Dean, Google Cloud. (2017, October 5). Significant FormBook Distribution Campaigns Impacting the U.S. and South Korea. Retrieved March 11, 2025.

    Open source URL
  78. [78]
    Google XLoader 2017

    Nart Villeneuve, Randi Eitzman, Sandor Nemes & Tyler Dean, Google Cloud. (2017, October 5). Significant FormBook Distribution Campaigns Impacting the U.S. and South Korea. Retrieved March 11, 2025.

    Open source URL
  79. [79]
    Google XLoader 2017

    Nart Villeneuve, Randi Eitzman, Sandor Nemes & Tyler Dean, Google Cloud. (2017, October 5). Significant FormBook Distribution Campaigns Impacting the U.S. and South Korea. Retrieved March 11, 2025.

    Open source URL
  80. [80]
    Google XLoader 2017

    Nart Villeneuve, Randi Eitzman, Sandor Nemes & Tyler Dean, Google Cloud. (2017, October 5). Significant FormBook Distribution Campaigns Impacting the U.S. and South Korea. Retrieved March 11, 2025.

    Open source URL
  81. [81]
    Google XLoader 2017

    Nart Villeneuve, Randi Eitzman, Sandor Nemes & Tyler Dean, Google Cloud. (2017, October 5). Significant FormBook Distribution Campaigns Impacting the U.S. and South Korea. Retrieved March 11, 2025.

    Open source URL
  82. [82]
    Google XLoader 2017

    Nart Villeneuve, Randi Eitzman, Sandor Nemes & Tyler Dean, Google Cloud. (2017, October 5). Significant FormBook Distribution Campaigns Impacting the U.S. and South Korea. Retrieved March 11, 2025.

    Open source URL
  83. [83]
    Google XLoader 2017

    Nart Villeneuve, Randi Eitzman, Sandor Nemes & Tyler Dean, Google Cloud. (2017, October 5). Significant FormBook Distribution Campaigns Impacting the U.S. and South Korea. Retrieved March 11, 2025.

    Open source URL
  84. [84]
    Zscaler XLoader 2025

    Zscaler Threatlabz. (2025, January 27). Technical Analysis of Xloader Versions 6 and 7 | Part 1. Retrieved March 11, 2025.

    Open source URL
  85. [85]
    Zscaler XLoader 2025

    Zscaler Threatlabz. (2025, January 27). Technical Analysis of Xloader Versions 6 and 7 | Part 1. Retrieved March 11, 2025.

    Open source URL
  86. [86]
    Google XLoader 2017

    Nart Villeneuve, Randi Eitzman, Sandor Nemes & Tyler Dean, Google Cloud. (2017, October 5). Significant FormBook Distribution Campaigns Impacting the U.S. and South Korea. Retrieved March 11, 2025.

    Open source URL
  87. [87]
    Google XLoader 2017

    Nart Villeneuve, Randi Eitzman, Sandor Nemes & Tyler Dean, Google Cloud. (2017, October 5). Significant FormBook Distribution Campaigns Impacting the U.S. and South Korea. Retrieved March 11, 2025.

    Open source URL
  88. [88]
    Google XLoader 2017

    Nart Villeneuve, Randi Eitzman, Sandor Nemes & Tyler Dean, Google Cloud. (2017, October 5). Significant FormBook Distribution Campaigns Impacting the U.S. and South Korea. Retrieved March 11, 2025.

    Open source URL
  89. [89]
    Google XLoader 2017

    Nart Villeneuve, Randi Eitzman, Sandor Nemes & Tyler Dean, Google Cloud. (2017, October 5). Significant FormBook Distribution Campaigns Impacting the U.S. and South Korea. Retrieved March 11, 2025.

    Open source URL
  90. [90]
    Zscaler XLoader 2025

    Zscaler Threatlabz. (2025, January 27). Technical Analysis of Xloader Versions 6 and 7 | Part 1. Retrieved March 11, 2025.

    Open source URL
  91. [91]
    Zscaler XLoader 2025

    Zscaler Threatlabz. (2025, January 27). Technical Analysis of Xloader Versions 6 and 7 | Part 1. Retrieved March 11, 2025.

    Open source URL
  92. [92]
    Acronis XLoader 2021

    Acronis. (2021, November 26). Trojan-as-a-service: From Formbook to XLoader. Retrieved March 11, 2025.

    Open source URL
  93. [93]
    Acronis XLoader 2021

    Acronis. (2021, November 26). Trojan-as-a-service: From Formbook to XLoader. Retrieved March 11, 2025.

    Open source URL
  94. [94]
    Acronis XLoader 2021

    Acronis. (2021, November 26). Trojan-as-a-service: From Formbook to XLoader. Retrieved March 11, 2025.

    Open source URL
  95. [95]
    Acronis XLoader 2021

    Acronis. (2021, November 26). Trojan-as-a-service: From Formbook to XLoader. Retrieved March 11, 2025.

    Open source URL
  96. [96]
    CheckPoint XLoader 2022

    Alexey Bukhteyev & Raman Ladutska, Check Point Research. (2022, May 31). XLoader Botnet: Find Me If You Can. Retrieved March 11, 2025.

    Open source URL
  97. [97]
    CheckPoint XLoader 2022

    Alexey Bukhteyev & Raman Ladutska, Check Point Research. (2022, May 31). XLoader Botnet: Find Me If You Can. Retrieved March 11, 2025.

    Open source URL
  98. [98]
    Netskope XLoader 2022

    Gustavo Palazolo, Netskope. (2022, March 11). New Formbook Campaign Delivered Through Phishing Emails. Retrieved March 11, 2025.

    Open source URL
  99. [99]
    Google XLoader 2017

    Nart Villeneuve, Randi Eitzman, Sandor Nemes & Tyler Dean, Google Cloud. (2017, October 5). Significant FormBook Distribution Campaigns Impacting the U.S. and South Korea. Retrieved March 11, 2025.

    Open source URL
  100. [100]
    Zscaler XLoader 2025

    Zscaler Threatlabz. (2025, January 27). Technical Analysis of Xloader Versions 6 and 7 | Part 1. Retrieved March 11, 2025.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use