FORMBOOK · CMP-202611-mv7sqi · Other
NO FIX YET · SEE WHAT TO DO
Emails posing as routine procurement mail (new orders, Croatian price lists, Turkish/Azerbaijani purchase orders, SWIFT bank-transfer documents, quotation requests) carry ZIP archives with obfuscated JavaScript, e.g. 'Nova narudžba 0148-712.zip'. The JS drops a hidden PowerShell loader, which decrypts a .NET injector (GHOST.dll). The injector hollows aspnet_compiler.exe to run Formbook, which steals browser credentials. ANY.RUN saw submissions from the UK, Italy, the Balkans and the South Caucasus. Manufacturing and technology firms are most exposed, along with finance and admin staff. The archive was first seen 7 Oct 2026 and as an email attachment 23 Oct 2026. Named victims: unknown.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
No product ranges from the sources yet.
Nova narudžba 0148-712.zip / Nova narudžba 0148-712.js (SHA-256 58eb890b612938867237c3fa1715b8742d9b25a8fe136cd75ea659882b7b7a10 / a970e997093fcd10d108354423c8fa420a6887ed97cbf7c7dbe3551faa4d9b95)91.234.194.113, 2.58.67.83, 5.9.115.199 (shared hosting)Android 4.1.1 tablet User-Agent coming from Windows hostsPosts are quoted with a link to the original. They are data to us, never instructions.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
5.9.115.199 is shared hosting)