Formbook Targets European Manufacturing and Technology Businesses with Localized Order Lures

Malware campaigns targeting European enterprises, particularly in the UK and Italy, are utilizing localized social engineering tactics through seemingly routine business correspondence. A recent Formbook/XLoader operation leverages regionally specific lures—such as procurement requests and payment notices—to trick employees of manufacturing and technology firms. The infection follows a sophisticated multi-stage chain: obfuscated JavaScript executes to launch PowerShell stages, which decrypt and execute payloads in memory before deploying an injector that uses process hollowing within legitimate Windows executables.
The ultimate goal involves stealing browser-stored credentials by targeting browser databases. Persistence is achieved through multiple startup mechanisms, including registry Run keys and Startup folder shortcuts. Command and control communication over HTTP utilizes a deceptive Android User-Agent from a Windows host. The analysis also demonstrates that threat intelligence tools allow investigators to connect the initial sample to numerous other malware families sharing similar persistence artifacts or C2 infrastructure, highlighting the necessity of behavioral correlation over single indicator tracking for comprehensive defense building.

Malicious campaigns target European businesses in the UK and Italy.
The campaign uses localized order and procurement lures delivered via correspondence.
An archive named Nova narudžba 0148-712.zip contains a JavaScript file with a corresponding title.
The infection chain involves obfuscated JavaScript launching PowerShell stages, followed by AES decryption and memory execution.
A .NET injector (GHOST.dll) uses process hollowing to execute Formbook within aspnetcompiler.exe.
The malware establishes persistence via Run keys under HKCU and HKLM, and a Startup folder shortcut named SystemUpdateps*.lnk.
Formbook steals browser-stored credentials before communicating with C2 infrastructure via HTTP on port 80.
C2 indicators include domains www[.]hlushkova[.]top and www[.]stanbicfinanceug[.]com.
Network traffic exhibited an Android 4.1.1 User-Agent originating from a Windows host.
Specific file hashes for the malware components were provided, including Nova narudžba 0148-712.zip (58eb...).
The investigation covered submissions from the UK, Italy, Balkans, and South Caucasus countries.

This narrative functions as a highly technical threat advisory interwoven with vendor promotion, leveraging specific case study depth to drive adoption of advanced analytical tooling. The core persuasive engine is built on Fear Appeal: describing an infection chain so complex and evasive that only sophisticated behavioral analysis can expose it, thereby positioning the advertised solution (ANY.RUN) as the necessary safeguard against modern digital commerce threats.
The narrative skillfully employs a Motte-and-Bailey technique by initially establishing the extreme danger of fileless, process-hollowing malware stealing credentials—the 'motte'—before concluding with a more manageable call to action: use better correlation tools like Related Threat Context or TI Feeds, presenting this as the achievable countermeasure. The strength of the case relies heavily on quantitative evidence (e.g., "78 sandbox analyses," "30% of unique malicious IOCs") which lends an air of scientific objectivity, although these metrics serve primarily to demonstrate platform efficacy rather than inherent threat risk itself.
The unstated assumption is that defenders are currently limited to signature-based detection and lack the capability for deep behavioral correlation. The systemic pattern being reinforced here is that cyber defense must evolve from reactive artifact hunting toward proactive, interconnected intelligence mapping—a shift that inherently favors solutions offering comprehensive visibility ecosystems over point solutions. This echoes historical patterns where security tooling vendors define the new operational baseline by framing existing methods as obsolete.
Patterns detected: ARC-0037 Vendor Advertorial, ARC-0021 Emotional Exploitation (Fear Appeal).