--- id: "CMP-202611-mv7sqi" page: "https://infrastack.ai/live/CMP-202611-mv7sqi" kind: "campaign" aliases: [] title: "Formbook (XLoader) infostealer hits European manufacturing and tech firms via fake purchase-order emails with ZIP/JavaScript attachments (ANY.RUN)" severity: "medium" cvss: null epss: null exploited: false status: "open" category: "other" products: [] ecosystems: [] tags: ["campaign", "early-warning"] not_affected_if: [] published_at: null first_seen_at: "2026-11-10T13:20:00+00:00" updated_at: "2026-11-10T13:21:33+00:00" sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-11-10T13:20:00+00:00"}] exploit_sources: [] --- # Formbook (XLoader) infostealer hits European manufacturing and tech firms via fake purchase-order emails with ZIP/JavaScript attachments (ANY.RUN) Link for people: https://infrastack.ai/live/CMP-202611-mv7sqi (this .md is for agents) Emails posing as routine procurement mail (new orders, Croatian price lists, Turkish/Azerbaijani purchase orders, SWIFT bank-transfer documents, quotation requests) carry ZIP archives with obfuscated JavaScript, e.g. 'Nova narudžba 0148-712.zip'. The JS drops a hidden PowerShell loader, which decrypts a .NET injector (GHOST.dll). The injector hollows aspnet_compiler.exe to run Formbook, which steals browser credentials. ANY.RUN saw submissions from the UK, Italy, the Balkans and the South Caucasus. Manufacturing and technology firms are most exposed, along with finance and admin staff. The archive was first seen 7 Oct 2026 and as an email attachment 23 Oct 2026. Named victims: unknown. _Summary, check and fix written by a model from the sources; labelled as such._ ## Cause How the attacker got in: a person was tricked (social-engineering). The campaign uses fake procurement emails with a ZIP/JavaScript attachment that a person at the victim must open, but the record does not say how the incident reached the users, customers or dependents of those firms. How it reached others: not stated (unknown). So it does not happen to you: Use phishing-resistant second factors on the accounts that matter, and never reset a factor on a phone call alone. Last month's incidents with the same cause, and the full checklist: https://infrastack.ai/live/causes.md#social-engineering ## How to check Lure: order/procurement emails with a ZIP holding a .js file, such as 'Nova narudžba 0148-712.zip' / 'Nova narudžba 0148-712.js' (SHA-256 58eb890b612938867237c3fa1715b8742d9b25a8fe136cd75ea659882b7b7a10 / a970e997093fcd10d108354423c8fa420a6887ed97cbf7c7dbe3551faa4d9b95). Sender domains: not given. On hosts: C:\Temp\ or %TEMP%\ps__.ps1 run by hidden PowerShell with execution-policy bypass; aspnet_compiler.exe or rekeywiz.exe launching Firefox; Run keys or Startup shortcuts named SystemUpdate_ps_*. Other SHA-256: loader b0ee22dee7a8a9710992294f73069f047d31506b50dc1150ef6013fcd6225ed1, injector 45e598a8dddd7e9cc7b7e7a2f319c0e9f3f090ad4a089e50c3c9e4d75ee9d718, GHOST.dll 2974a808e24e76c1a9fecdaaecebefe27e841204bc1aa20536c32c1f0b309f47, Formbook f5c9a28325ed2eab5c7d029bfed410f05ae858b6b436e3b14891f29a6ec96d73, shortcut 4fd6430a61e5d42a452c3a7de94d03173b9eb02d06aa33357fe5ee9776524aec. Network: www[.]hlushkova[.]top/ef5f/, www[.]stanbicfinanceug[.]com/9wgi/, IPs 91.234.194.113, 2.58.67.83, 5.9.115.199 (shared hosting). HTTP on port 80 with an 'Android 4.1.1 tablet' User-Agent coming from Windows hosts. ## Fix Block or quarantine emailed ZIP archives that contain .js files. Make .js open in Notepad instead of Windows Script Host. Block the listed domains (by domain, since 5.9.115.199 is shared hosting). Hunt for the file, registry and User-Agent indicators. On any infected host, reset browser-saved passwords and sessions. ## Timeline - 2026-11-10T13:20:00+00:00 analyst ## Documents - [describes] ANY.RUN: Formbook Targets European Manufacturing and Technology Businesses with Localized Order Lures https://any.run/cybersecurity-blog/formbook-malware-analysis-november-2026/ --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_