Xloader -

XLoader is a modular Malware-as-a-Service (MaaS) platform primarily functioning as a "stealer" and a "loader." Active since at least 2016 (under its original guise, Formbook), it has remained a dominant force in the threat landscape due to its agility, sophisticated obfuscation techniques, and a business model that lowers the barrier to entry for cybercriminals.

While often referred to interchangeably with Formbook, XLoader represents the evolution of that strain, specifically rebranded around 2020 to introduce cross-platform capabilities (macOS and Windows) and enhanced anti-analysis features. It is designed to steal credentials, log keystrokes, take screenshots, and download and execute subsequent payloads (hence the term "loader").

For security professionals, detecting XLoader requires looking beyond simple virus signatures. Here are the key indicators of compromise (IoCs):

File Names (Observed in the wild):

Registry Keys (Persistence):

Network Traffic (C2 Patterns):

YARA Rules: A classic rule to detect XLoader looks for the unique string "XLoader_Client" within the binary, along with its distinct packing algorithm. xloader

XLoader on Windows is a staged loader:

XLoader is almost exclusively distributed via phishing and malicious spam (malspam) with three primary lures:

| Vector | Method | Example | |--------|--------|---------| | Office Macros | VBA script in Excel/Word attachments | “Purchase Order #2309.xlsm” | | Disk Images (macOS) | DMG files signed with ad-hoc certs | “AdobeFlashPlayer.dmg” | | ISO/ZIP archives | Bypassing webmail attachment filters | “Invoice_10345.zip” containing .lnk + .exe | Registry Keys (Persistence):

Notable 2024 Tactic: Threat actors began embedding XLoader inside NuGet packages (Microsoft .NET package manager) and malicious npm modules, abusing developer workflows to spread the loader via supply chain poisoning.

XLoader is classified as an Information Stealer (Infostealer) , but calling it just a stealer undersells its modular architecture. Once XLoader establishes a foothold on a victim’s machine, it performs a variety of malicious actions: