Skip to content
brandefense.io
Request A Demo
UnclassifiedUnknown

XLoader

XLoader is a threat actor group, tracked by Brandefense.

Request IOC feedRequest ATT&CK export
Techniques
0
Exploited CVEs
No CVE data
Record updated

About XLoader.

FormBook is a data stealer, but not a full-fledged banker (banking malware). It does not currently have any extensions or plug-ins. Its capabilities include: • Key logging • Clipboard monitoring • Grabbing HTTP/HTTPS/SPDY/HTTP2 forms and network requests • Grabbing passwords from browsers and email clients • Screenshots FormBook can receive the following remote commands from the C2 server: • Update bot on host system • Download and execute file • Remove bot from host system • Launch a command via ShellExecute • Clear browser cookies • Reboot system • Shutdown system • Collect passwords and create a screenshot • Download and unpack ZIP archive.

Last updated Sep 12, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.