Hackers Hide XLoader Malware in Fake Business Orders to Steal Passwords and Evade Detection
A new XLoader malware campaign uses fake business orders and price quotes to deliver the password-stealing malware, employing sophisticated evasion techniques to bypass security defenses.
A new campaign is distributing the XLoader password-stealing malware, a variant of the FormBook family, by disguising malicious emails as routine business orders and price quote requests. These emails, often written in Greek or Slovenian and featuring realistic order numbers, aim to trick recipients into opening an attached RAR archive.
Upon opening the archive, users are presented with an obfuscated JScript file that, when executed, initiates a complex infection chain. This script attempts to evade initial detection by deleting its own Zone.Identifier stream, a marker Windows uses to flag files downloaded from the internet. It then unpacks two files into the user's Documents folder: a LuaJIT interpreter and a Lua program without a file extension.
The Lua program, executed via the interpreter in a hidden window, employs advanced techniques to blind security tools. It actively searches for and attempts to disable the Antimalware Scan Interface (AMSI) and overwrites critical functions within the ntdll library responsible for Windows event tracing. These actions are designed to prevent security software from scanning the malware's core components and to disrupt system logging.
Following these evasion steps, the Lua loader decodes a large, encrypted blob directly into memory. This payload, lacking an import table, is difficult for scanners to analyze. It dynamically locates necessary Windows functions and decrypts the XLoader core using RC4 encryption, ensuring that only the initial script, interpreter, and Lua file ever touch the disk, making forensic analysis more challenging.
XLoader then injects itself into a legitimate, running Windows process. Instead of traditional process hollowing, it utilizes a shared memory section to copy itself into a target process and modifies the process's thread context to execute the malicious code. This method avoids common detection triggers like WriteProcessMemory calls and preserves the original host program's image.
Once active, XLoader is capable of stealing sensitive information, including saved passwords from Windows Vault entries and browser cookies. The malware is configured to communicate with a list of potential command-and-control servers, many of which are decoys, making it harder for defenders to identify the actual infrastructure.
This campaign highlights the persistent threat of information stealers like XLoader, which are often sold as malware-as-a-service, lowering the barrier to entry for cybercriminals. The use of business-themed lures and sophisticated memory-resident evasion techniques demonstrates an ongoing effort to bypass traditional security measures.
To mitigate this threat, organizations should treat archives containing script files with suspicion, even if they appear to be legitimate business documents. Blocking JS files within RAR and ZIP attachments at the mail gateway, monitoring for suspicious LuaJIT processes originating from the Documents folder, and training users to identify phishing attempts remain crucial defense strategies. Full password resets for affected accounts are also recommended.