Beware Of Malicious SharePoint Notifications Delivering Xloader Malware

A sophisticated phishing campaign impersonating Microsoft SharePoint delivers the Xloader (Formbook) infostealer by redirecting victims to externally hosted ZIP files containing disguised executables; the attack chain uses obfuscation, AutoIT scripts, shellcode and process-hijacking and leverages "living-off-trusted-sites" tactics to evade detection. Sublime Security flagged indicators such as brand impersonation, malicious redirect URLs, and SPF failures; recommended mitigations include email verification, URL inspection, MFA, user training, and advanced email/endpoint protections.