Threat intelligence / Malware

XLoader

[XLoader](https://attack.mitre.org/software/S1207) is an infostealer malware in use since at least 2016. Previously known and sometimes still referred to as Formbook, [XLoader](https://attack.mitre.org/software/S1207) is a Malware as a Service (MaaS) known for stealing data from web browsers, email clients and File Transfer Protocol (FTP) applications.(Citation: Zscaler XLoader 2025)(Citation: ANY.RUN XLoader 2023)(Citation: CheckPoint XLoader 2022)(Citation: Acronis XLoader 2021)(Citation: Google XLoader 2017)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[XLoader](https://attack.mitre.org/software/S1207) is an infostealer malware in use since at least 2016. Previously known and sometimes still referred to as Formbook, [XLoader](https://attack.mitre.org/software/S1207) is a Malware as a Service (MaaS) known for stealing data from web browsers, email clients and File Transfer Protocol (FTP) applications.(Citation: Zscaler XLoader 2025)(Citation: ANY.RUN XLoader 2023)(Citation: CheckPoint XLoader 2022)(Citation: Acronis XLoader 2021)(Citation: Google XLoader 2017)

Labels

malware

28 recorded

Relationships

uses

to Asynchronous Procedure Call

Technique

uses

to AutoHotKey & AutoIT

Technique

uses

to Browser Session Hijacking

Technique

uses

to Clipboard Data

Technique

uses

to Credentials from Password Stores

Technique

uses

to Credentials from Web Browsers

Technique

uses

to Debugger Evasion

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Disable or Modify Tools

Technique

uses

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Exploitation for Client Execution

Technique

uses

to File Deletion

Technique

uses

Technique

uses

Technique

uses

to Process Hollowing

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Scheduled Task

Technique

uses

to Screen Capture

Technique

uses

to Software Packing

Technique

uses

to Spearphishing Attachment

Technique

uses

to Steal Web Session Cookie

Technique

uses

to System Checks

Technique

uses

to System Information Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to System Shutdown/Reboot

Technique

uses

to Virtualization/Sandbox Evasion

Technique

uses

to Web Protocols

Technique

7 external

References

mitre-attack

S1207

Formbook

—

Acronis XLoader 2021

https://www.acronis.com/en-us/cyber-protection-center/posts/trojan-as-a-service-from-formbook-to-xloader/

CheckPoint XLoader 2022

https://research.checkpoint.com/2022/xloader-botnet-find-me-if-you-can/

ANY.RUN XLoader 2023

https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/

Google XLoader 2017

https://cloud.google.com/blog/topics/threat-intelligence/formbook-malware-distribution-campaigns/

Zscaler XLoader 2025

https://www.zscaler.com/blogs/security-research/technical-analysis-xloader-versions-6-and-7-part-1