Xloader Returns with New Infection Technique

This technical analysis details a multi-stage Xloader infostealer delivery: a malicious PDF drops an embedded XLSX which fetches an RTF that abuses CVE-2017-11882 to launch an obfuscated .NET loader (vbc.exe); that loader decodes and loads staged assemblies, uses steganography (a compressed bitmap in resources) to extract a second-stage .NET payload (MajorRevision.exe), and ultimately performs process hollowing to inject a MASM-compiled Xloader binary which persists via a registry Run key and exfiltrates credentials, keystrokes, clipboard data, cookies, and screenshots; the report includes MITRE ATT&CK technique mappings, detailed IOCs (file hashes and C2 URLs), and recommended mitigations.