FormBook Malware Uses Phishing, DLL Side-Loading, JavaScript

Pulse ID: 69e9a4e4703c018de7e0f325
Pulse Link: https://otx.alienvault.com/pulse/69e9a4e4703c018de7e0f325
Pulse Author: Tr1sa111
Created: 2026-04-23 04:49:40

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #FormBook #InfoSec #Java #JavaScript #Malware #OTX #OpenThreatExchange #Phishing #bot #Tr1sa111

FormBook Malware Uses Phishing, DLL Side-Loading, JavaScript

Two distinct phishing campaigns have been identified targeting companies in Greece, Spain, Slovenia, Bosnia and Central American countries to deliver FormBook data-stealing malware. The first campaign uses RAR attachments containing legitimate executables like Sandboxie ImBox.exe, TikTok desktop, Adobe PDF Preview Handler, and XZ Utils, exploiting DLL side-loading with malicious DLL files. The second campaign deploys heavily obfuscated JavaScript that drops encrypted PNG files, uses PowerShell with Base64 encoding, and leverages a custom .NET loader called Mandark to inject the payload into RegAsm process. Both campaigns deliver the same FormBook executable that employs advanced evasion by manually mapping ntdll.dll in memory to bypass user-mode monitoring and perform direct syscalls, enabling credential theft and data collection from browsers while avoiding detection mechanisms.

Pulse ID: 69e8c267419390d6722afdd5
Pulse Link: https://otx.alienvault.com/pulse/69e8c267419390d6722afdd5
Pulse Author: AlienVault
Created: 2026-04-22 12:43:19

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Adobe #Browser #CentralAmerica #CyberSecurity #FormBook #InfoSec #Java #JavaScript #Malware #NET #OTX #OpenThreatExchange #PDF #Phishing #PowerShell #SMS #Slovenia #Spain #bot #AlienVault

📢 Xloader v8.1+ : nouvelles techniques d'obfuscation et protocole C2 détaillés
📝 ## 🔍 Contexte

Publié le 31 mars 2026 par ThreatLabz (Zscaler), cet article constitue une analyse technique approf...
📖 cyberveille : https://cyberveille.ch/posts/2026-04-05-xloader-v8-1-nouvelles-techniques-d-obfuscation-et-protocole-c2-detailles/
🌐 source : https://www.zscaler.com/blogs/security-research/latest-xloader-obfuscation-methods-and-network-protocol
#C2_protocol #FormBook #Cyberveille

🎯 Registry abuse helps #malware maintain persistence on infected endpoints. By detonating files in #ANYRUN Sandbox, analysts gain instant threat visibility to accelerate investigations and response.

👨‍💻 See #FormBook and script-based attacks analysis: https://any.run/cybersecurity-blog/how-to-spot-malware-registry-abuse/?utm_source=mastodon&utm_medium=post&utm_campaign=registry_abuse&utm_term=070825&utm_content=linktoblog

#cybersecurity #infosec

🎯 Registry abuse helps #malware maintain persistence and stealth on infected endpoints.
Detonating suspicious files in #ANYRUN Sandbox gives instant visibility into registry activity.

Explore examples, featuring #FormBook and script-based attacks 👇
https://any.run/cybersecurity-blog/how-to-spot-malware-registry-abuse/?utm_source=mastodon&utm_medium=post&utm_campaign=spot_registry_abuse&utm_term=240625&utm_content=linktoblog

#cybersecurity #infosec