XLoader Malware Upgrades Obfuscation Tactics and Hides C2 Traffic Behind Decoy Servers

XLoader (formerly FormBook) is an actively developed information-stealing malware that exfiltrates browser and email credentials, executes arbitrary commands, and can deploy additional payloads. Recent versions (from 8.1 onward) add strong code/network obfuscation—including a runtime-decrypted pool of 65 C2 IPs (randomly contacting 16), RC4 and SHA-1 based layering, and Base64-encoded parameters—making static analysis and automated detection difficult; distribution remains primarily via phishing and malicious attachments, and detection is tracked as Win32.PWS.XLoader.