Threat reportMalwareTL-2026-5227

XLoader (FormBook) Infostealer Delivered via Fake Business Order Phishing, RAR/JScript/LuaJIT Chain with In-Memory Injection

highACTIVE

Phishing emails posing as business orders and price quotes deliver RAR archives containing obfuscated JScript that unpacks a LuaJIT interpreter and Lua loader, starting a memory-only XLoader infection chain. The chain patches AMSI/ETW-related ntdll functions and injects XLoader into 32-bit Windows binaries via shared memory sections to steal Windows Vault credentials and browser cookie records.

Key facts for XLoader fake order phishing

Identifiers	TL-2026-5227
Also known as	Xloader, FormBook successor
Severity	HIGH
First disclosed	2026-11-01
Exploitation status	Exploited in the wild
Affected products	Microsoft Windows
Malware	Agent Tesla, Formbook, MoqHao, XWorm
Tools	Remcos
MITRE ATT&CK techniques	T1027.013 Encrypted/Encoded File, T1053.005 Scheduled Task, T1055 Process Injection, T1055.003 Thread Execution Hijacking, T1059.005 Visual Basic, T1059.007 JavaScript, T1071.001 Web Protocols, T1106 Native API, T1140 Deobfuscate/Decode Files or Information, T1204.002 Malicious File, T1539 Steal Web Session Cookie, T1553.005 Mark-of-the-Web Bypass and 5 more in the attack flow
Motivation	FINANCIAL
Target sectors	business services, general enterprise
Target regions	greece, slovenia, Global
Detection rules	9 (1 shown free)
Sources	7 cited sources

Detection coverage for XLoader fake order phishing

As of 2026-11-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5227 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: XLoader LuaJIT Loader Chain Executed From User Documents (EHFTUOMQDRXVTJSF / FSJTVXRDQMOUTFHE)

Detects the execution stage of the XLoader (FormBook successor) order-lure chain documented by Morphisec: an obfuscated JScript run by wscript/cscript drops a LuaJIT interpreter (EHFTUOMQDRXVTJSF.exe), a Lua loader (FSJTVXRDQMOUTFHE) and a VBS launcher into the user's Documents folder and starts them. Matches the known LuaJIT filename and loader name, the community-corroborated LuaJIT SHA256, and the behavioural pattern of a script host spawning an executable from Documents. Early detection here precedes AMSI/ETW patching and in-memory XLoader injection.

Languages: Splunk SPL, Microsoft KQL, Sigma
ATT&CK: T1204.002, T1059.007, T1059.005, T1140
Data sources: sysmon_event_id_1, windows_process_creation, defender_DeviceProcessEvents
Severity: high
Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(Image="*\\EHFTUOMQDRXVTJSF.exe" OR CommandLine="*FSJTVXRDQMOUTFHE*" OR CommandLine="*EHFTUOMQDRXVTJSF*" OR Hashes="*d447a06cba8d3dbe80e09d73dd64576836b258961ee0d3ba56cf26cea7962b49*" OR (ParentImage IN ("*\\wscript.exe", "*\\cscript.exe") AND Image="*\\Documents\\*.exe"))
| eval lua_loader_args=if(like(lower(CommandLine), "%fsjtvxrdqmoutfhe%") OR like(lower(CommandLine), "%.lua%"), 1, 0)
| stats count min(_time) AS first_seen max(_time) AS last_seen max(lua_loader_args) AS lua_loader_args values(Image) AS images values(ParentImage) AS parent_images values(CommandLine) AS command_lines BY host, User
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "EHFTUOMQDRXVTJSF.exe"
    or ProcessCommandLine has_any ("FSJTVXRDQMOUTFHE", "EHFTUOMQDRXVTJSF")
    or SHA256 =~ "d447a06cba8d3dbe80e09d73dd64576836b258961ee0d3ba56cf26cea7962b49"
    or (InitiatingProcessFileName in~ ("wscript.exe", "cscript.exe") and FolderPath contains @"\Documents\" and FileName endswith ".exe")
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256

Sigma

title: XLoader LuaJIT Loader Chain Executed From User Documents
id: 7c1d4e9a-52b3-4f68-a1c7-0e9d3b8f2a11
status: experimental
description: Detects execution of the XLoader order-lure chain components (EHFTUOMQDRXVTJSF.exe LuaJIT host, FSJTVXRDQMOUTFHE Lua loader) or a script host spawning an executable from the user's Documents folder.
references:
  - https://www.morphisec.com/blog/from-business-emails-to-xloader-an-order-lure-that-led-to-in-memory-injection/
  - https://cybersecuritynews.com/hackers-hide-xloader-malware/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-04
tags:
  - attack.execution
  - attack.t1204.002
  - attack.t1059.007
  - attack.t1059.005
  - attack.defense_evasion
  - attack.t1140
logsource:
  category: process_creation
  product: windows
detection:
  selection_name:
    Image|endswith: '\EHFTUOMQDRXVTJSF.exe'
  selection_cmd:
    CommandLine|contains:
      - 'FSJTVXRDQMOUTFHE'
      - 'EHFTUOMQDRXVTJSF'
  selection_hash:
    Hashes|contains: 'D447A06CBA8D3DBE80E09D73DD64576836B258961EE0D3BA56CF26CEA7962B49'
  selection_chain:
    ParentImage|endswith:
      - '\wscript.exe'
      - '\cscript.exe'
    Image|contains: '\Documents\'
    Image|endswith: '.exe'
  condition: 1 of selection_*
falsepositives:
  - Legitimate admin or line-of-business scripts that launch a signed executable from a Documents folder
level: high

Known false positives:

Legitimate logon or admin scripts (wscript/cscript) that start a signed executable from a user Documents folder
Developers running portable tools or interpreters from Documents via script wrappers

Tuning notes: Name and hash branches are near-zero false positive; the wscript/cscript-to-Documents-exe branch is behavioural, so allowlist known admin script paths and signed publishers. Requires Sysmon EID 1 with Hashes enabled (SHA256). Add other Lua loader SHA256 values from research.json iocs[] to the hash branch as they are confirmed.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)

JScript/JSE Launched by Windows Script Host From RAR Extraction (Order-Lure Phishing) · unlock with TL Creds
XLoader Section-Object and Thread-Context Injection Into 32-bit Host Processes · unlock with TL Creds
XLoader C2, Delivery Infrastructure and Community-Observed Sibling Network Connections · unlock with TL Creds
XLoader Dropped Artifacts in User Documents and Zone.Identifier Removal · unlock with TL Creds
Windows Vault Credential Library Loaded by XLoader Host or LuaJIT Process · unlock with TL Creds
DNS Resolution of XLoader C2, Delivery and Community-Observed Sibling Domains · unlock with TL Creds
XLoader Scheduled Task Persistence (EHFTUOMQDRXVTJSF, 10-Minute Repeat) · unlock with TL Creds
XLoader Injected Host Process Making Outbound Network Connections · unlock with TL Creds

Indicators of compromise for XLoader fake order phishing

As of 2026-11-04, Threadlinqs Intelligence tracks 26 indicators of compromise for TL-2026-5227.

Sample indicators (3 of 26)

IP address: 66.113.160[.]32
Domain: focused-albattani[.]66-113-160-32[.]plesk[.]page
File hash: e834ea9cd3025f8070778cf7ef8219976568cc28085feaf974912b64e5b77bc8

Defanged, TLP:CLEAR. Full set of 26 indicators: unlock with TL Creds.

26 indicators of compromise · unlock with TL Creds. Compare plans

Community OSINT corroboration for XLoader fake order phishing

1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

How XLoader fake order phishing works

Morphisec research (reported by Cybersecurity News on 2026-11-04) documents an XLoader campaign, the successor to the FormBook infostealer, that uses business-themed phishing emails (order confirmations, quotations, invoice requests) with RAR attachments. Lures were observed in Greek and Slovenian, and earlier variants of the campaign spoofed SharePoint notifications. The same campaign infrastructure was also observed delivering Agent Tesla, Remcos and XWorm.

The RAR contains an obfuscated JScript file. On execution it drops a LuaJIT interpreter (EHFTUOMQDRXVTJSF.exe), a Lua loader (FSJTVXRDQMOUTFHE) and a VBS launcher (FSJTVXRDQMOUTFHE.vbs) into the user's Documents folder, and removes the Zone.Identifier stream. The Lua program attempts to erase AMSI functions and patch 12 ntdll functions (EtwEventWrite, EtwEventWriteFull, EtwEventWriteTransfer, EtwEventWriteString, NtTraceEvent, EtwEventEnabled, NtOpenThread, NtSuspendThread, NtTerminateThread, NtTerminateProcess, NtSuspendProcess, NtCreateSection), then decodes a packed PE in memory. The packed PE decrypts the XLoader core with RC4, selectively decrypting routines during execution.

XLoader is injected into a 32-bit target process using shared section objects and thread-context redirection rather than WriteProcessMemory. Twelve candidate host processes are named: cleanmgr.exe, clip.exe, TSTheme.exe, getmac.exe, UserAccountControlSettings.exe, proquota.exe, SearchProtocolHost.exe, mobsync.exe, mshta.exe, ftp.exe, fsutil.exe and find.exe. Persistence is conditional: a scheduled task named EHFTUOMQDRXVTJSF runs every 10 minutes if the .mui marker file exists. The malware enumerates the Windows Vault and collects cookie records. C2 uses HTTP GET with a Winsock fallback, with 16 configured C2 slots and POST parameters such as dat=, &un= and &br=9 behind a PKT2: marker. Per Zscaler ThreatLabz research, XLoader mixes decoy hosts with real C2 servers and derives network encryption keys from the C2 URL, so not every listed domain is necessarily operator-controlled.

No CVE, CVSS score or named threat actor is given in the sources; severity is an analyst assessment. Delivery used a relay at 66.113.160.32 and the host webmail.bekdachegroup.com. The Morphisec primary report was retrieved only as a summarized fetch; hash and C2 values were consistent between it and the news article.

MITRE ATT&CK techniques by tactic:

Remediation for XLoader fake order phishing

Immediate actions

Block the delivery relay 66.113.160.32 and the listed delivery hostnames and C2 domains at the proxy/DNS layer
Hunt for EHFTUOMQDRXVTJSF scheduled task, EHFTUOMQDRXVTJSF.exe/.mui and FSJTVXRDQMOUTFHE files in user Documents folders
Reset credentials and invalidate browser sessions for any user on a host where the chain executed

Workarounds

Associate .js/.jse/.vbs files with a text editor instead of Windows Script Host via policy
Enable Attack Surface Reduction rule blocking JavaScript/VBScript from launching downloaded executable content

Longer-term hardening

Block or sandbox RAR attachments containing script files (.js/.jse/.vbs) at the mail gateway
Deploy EDR with detection of ntdll/AMSI patching, section-object injection and thread-context redirection into 32-bit system binaries
Monitor for LuaJIT interpreters launching from user profile folders

Affected and fixed versions

Microsoft — Windows
Vulnerable versions: Windows endpoints able to run JScript and 32-bit (SysWOW64) processes

Timeline of XLoader fake order phishing

2016-01-01 FormBook infostealer introduced in 2016 (year-level date per Zscaler ThreatLabz)
2020-01-01 FormBook rebranded as Xloader in early 2020 (month-level date per Zscaler ThreatLabz)
2021-09-01 BlackBerry publishes 'Threat Thursday - XLoader Infostealer' documenting Xloader as the FormBook successor (month-level date per URL path)
2025-01-01 Zscaler ThreatLabz publishes technical analysis of Xloader versions 6 and 7 covering section-object injection, ntdll hook evasion and runtime code encryption (January 2025 per Security Boulevard repost)
2025-02-13 Zscaler ThreatLabz publishes Part 2 of its Xloader versions 6 and 7 analysis (v7.5 examined; each decoy and real C2 has its own URL path)
2026-03-31 Zscaler ThreatLabz publishes analysis of latest Xloader obfuscation methods and network protocol (v8.1 randomized egg construction and XOR-encrypted function prologues; v8.7 latest observed)
2026-11-01 Morphisec publishes analysis of the order-lure RAR/JScript/LuaJIT XLoader chain with shared-section injection (date as reported in the retrieved page summary)
2026-11-04 Cybersecurity News reports the campaign, including hashes, delivery relay locked-ioc-18 and 16 C2 endpoints

Sources cited for XLoader fake order phishing

Morphisec: From Business Emails to XLoader - An Order Lure That Led to In-Memory Injection morphisec.com · Research · 2026-11-01
Zscaler ThreatLabz: Technical Analysis of Xloader Versions 6 and 7 Part 1 zscaler.com · Research · 2025-01-01
Zscaler ThreatLabz: Technical Analysis of Xloader Versions 6 and 7 Part 2 zscaler.com · Research · 2025-02-13
Zscaler ThreatLabz: Latest Xloader Obfuscation Methods and Network Protocol zscaler.com · Research · 2026-03-31
BlackBerry: Threat Thursday - XLoader Infostealer blogs.blackberry.com · Blog · 2021-09-01
Hackers Hide XLoader Malware in Fake Business Orders to Steal Passwords and Evade Detection cybersecuritynews.com · News · 2026-11-04
Security Boulevard: Technical Analysis of Xloader Versions 6 and 7 Part 1 securityboulevard.com · News · 2025-01-01

Drafted by the Threadlinqs research pipeline from 7 sources; published 2026-11-04; last updated —.

XLoader (FormBook) Infostealer Delivered via Fake Business Order Phishing, RAR/JScript/LuaJIT Chain with In-Memory Injection

Key facts for XLoader fake order phishing

Detection coverage for XLoader fake order phishing

Free detection: XLoader LuaJIT Loader Chain Executed From User Documents (EHFTUOMQDRXVTJSF / FSJTVXRDQMOUTFHE)

Splunk SPL

Microsoft KQL

Sigma

Indicators of compromise for XLoader fake order phishing

Sample indicators (3 of 26)

Community OSINT corroboration for XLoader fake order phishing

How XLoader fake order phishing works

Defense Evasion

Persistence

Privilege Escalation

Execution

Command and Control

Credential Access

defense-impairment

Initial Access

Remediation for XLoader fake order phishing

Immediate actions

Workarounds

Longer-term hardening

Affected and fixed versions

Timeline of XLoader fake order phishing

Sources cited for XLoader fake order phishing

Latest Threats

🔄 Threat Comparison

XLoader (FormBook) Infostealer Delivered via Fake Business Order Phishing, RAR/JScript/LuaJIT Chain with In-Memory Injection

Key facts for XLoader fake order phishing

Detection coverage for XLoader fake order phishing

Free detection: XLoader LuaJIT Loader Chain Executed From User Documents (EHFTUOMQDRXVTJSF / FSJTVXRDQMOUTFHE)

Splunk SPL

Microsoft KQL

Sigma

Indicators of compromise for XLoader fake order phishing

Sample indicators (3 of 26)

Community OSINT corroboration for XLoader fake order phishing

How XLoader fake order phishing works

Defense Evasion

Persistence

Privilege Escalation

Execution

Command and Control

Credential Access

defense-impairment

Initial Access

Remediation for XLoader fake order phishing

Immediate actions

Workarounds

Longer-term hardening

Affected and fixed versions

Timeline of XLoader fake order phishing

Sources cited for XLoader fake order phishing

More in malware

Latest Threats

🔄 Threat Comparison