{
  "family": "formbook",
  "sample_count": 35,
  "category": "spyware",
  "description": "<h3>Executive Summary</h3>\nFormBook is a highly prevalent Information Stealer (InfoStealer) and Form Grabber that has been sold as Malware-as-a-Service (MaaS) on underground hacking forums since 2016. It is explicitly designed to harvest sensitive user data, including login credentials, banking details, and personal information, directly from the memory of web browsers and other applications before it is encrypted and sent over the network.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nFormBook operators rely almost exclusively on massive phishing and malspam campaigns. Lures typically impersonate shipping companies (DHL, FedEx) or financial institutions, containing malicious attachments (PDFs, DOCX with macros, or executable files disguised as invoices).\n\nIts technical operation focuses on comprehensive data theft:\n<ul>\n<li><strong>API Hooking (Form Grabbing):</strong> FormBook's core capability is hooking Windows APIs (like `HttpSendRequest` or `NtWriteFile`). This allows it to intercept \"forms\" (like a login page on a banking site) and steal the username and password *as the user types them*, bypassing HTTPS encryption.</li>\n<li><strong>Comprehensive Stealing:</strong> Beyond form grabbing, it actively steals saved passwords from browser credential stores (Chrome, Firefox, Edge), FTP clients (FileZilla), and email clients (Outlook). It also features built-in keylogging and clipboard monitoring capabilities.</li>\n<li><strong>Defense Evasion:</strong> The malware often uses process injection (e.g., injecting into `explorer.exe` or `svchost.exe`) to hide its activity and communicates with its Command and Control (C2) server using custom, obfuscated HTTP requests designed to blend in with normal web traffic.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA FormBook infection is a severe data breach. The immediate threat is the total compromise of every account the user accesses from the infected machine, leading directly to financial fraud, Business Email Compromise (BEC), and potential corporate network breaches if VPN credentials are stolen.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Mandatory Credential Reset:</strong> The absolute highest priority is an immediate, global password reset for all accounts associated with the compromised user, especially Active Directory, webmail, and banking portals.</li>\n<li><strong>MFA Enforcement:</strong> Ensure strict Multi-Factor Authentication (MFA) is enforced across all external-facing corporate portals to neutralize the threat of the stolen credentials being reused by the attackers.</li>\n<li><strong>EDR Triage and Eradication:</strong> Utilize Endpoint Detection and Response (EDR) to trace the execution chain, kill the injected processes, and remove the FormBook executable and its persistence mechanisms (typically Registry `Run` keys).</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "InfoStealer.FormBook",
    "Trojan.FormGrabber",
    "Win32/FormBook"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is FormBook?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "A widely-sold information stealer, in use since at least 2016, that harvests credentials and data from browsers, email, and FTP clients."
      }
    },
    {
      "@type": "Question",
      "name": "What is the relationship between FormBook and XLoader?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "XLoader is the later evolution of FormBook; MITRE tracks the lineage together, with FormBook as the earlier name."
      }
    },
    {
      "@type": "Question",
      "name": "How is FormBook sold?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "As a Malware-as-a-Service (MaaS), rented out to different operators."
      }
    },
    {
      "@type": "Question",
      "name": "How is FormBook distributed?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Through phishing campaigns with malicious attachments or links."
      }
    },
    {
      "@type": "Question",
      "name": "How can I protect credentials from FormBook/XLoader?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Use a password manager and multi-factor authentication, and be cautious with unexpected attachments."
      }
    },
    {
      "@type": "Question",
      "name": "Where is the authoritative reference?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "MITRE ATT&CK's XLoader/FormBook entry (S1207), linked on this page."
      }
    }
  ],
  "faq_count": 6,
  "mitre_attack": [
    "T1056.001",
    "T1555.003",
    "T1055"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-02T07:47:42Z",
  "overview_short": "FormBook (and its successor XLoader) is a commodity infostealer that harvests credentials from over 90 applications, captures keystrokes, and grabs form data. It is sold on underground forums and frequently delivered via phishing.",
  "first_seen": "2016",
  "status": "active",
  "iocs": {
    "delivery": [
      "Phishing with RAR/ZIP/ISO attachments",
      "Office documents using CVE-2017-11882",
      "GuLoader and Snake-Loader downloaders"
    ],
    "network": [
      "HTTP POST to compromised WordPress sites acting as C2 gates",
      "Domain rotation with randomized URI paths",
      "Beacon every 60-120 seconds"
    ],
    "persistence": [
      "Process hollowing into explorer.exe or signed Windows binaries",
      "Run keys with randomized names",
      "No on-disk artifact in some campaigns (memory-resident)"
    ]
  },
  "detection": [
    "Suricata FormBook C2 ruleset",
    "EDR rule for process hollowing of explorer.exe at startup",
    "YARA rule FormBook_Stealer"
  ],
  "containment_steps": [
    "Isolate host and collect volatile memory",
    "Rotate all browser-stored and FTP-client credentials",
    "Block C2 gate URLs at perimeter and DNS",
    "Audit other hosts in the org receiving the same phishing lure"
  ],
  "what_to_avoid": [
    "Do not rely on disk-based AV scans alone — FormBook often runs in memory only",
    "Do not assume container files like ISO are safe to open",
    "Do not delay credential rotation"
  ],
  "references": [
    {
      "title": "CISA Top Malware Strains 2021 / 2023",
      "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-242a"
    },
    {
      "title": "Check Point Research: XLoader / FormBook evolution",
      "url": "https://research.checkpoint.com/2021/time-proven-tricks-in-a-new-environment-the-macos-evolution-of-formbook/"
    }
  ],
  "mitre_attack_detail": [
    {
      "id": "T1566.001",
      "name": "Spearphishing Attachment"
    },
    {
      "id": "T1055.012",
      "name": "Process Hollowing"
    },
    {
      "id": "T1555.003",
      "name": "Credentials from Web Browsers"
    },
    {
      "id": "T1056.001",
      "name": "Keylogging"
    }
  ],
  "sources": [
    {
      "name": "MITRE ATT&CK: XLoader / FormBook (S1207)",
      "url": "https://attack.mitre.org/software/S1207"
    }
  ],
  "mitre_url": "https://attack.mitre.org/software/S1207",
  "type": "InfoStealer / FormGrabber",
  "target_industries": [
    "Government",
    "Defense",
    "Journalists"
  ],
  "motivation": "Espionage",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}