Back Scworld

Formbook infostealer deployed in clandestine phishing campaigns | brief

Scworld • April 21, 2026

Organizations in multiple South American countries, Bosnia, Croatia, Greece, Slovenia, and Spain have had their Windows systems stealthily infected with the Formbook information-stealing malware in a pair of phishing campaigns, reports Infosecurity Magazine .

Attacks part of the first campaign involved the delivery of malicious emails with a RAR attachment containing three DLLs and a Windows executable file, with DLL side-loading ensuring the execution of Formbook without being detected by the system, according to a WatchGuard analysis. On the other hand, phishing emails in the second campaign featured JavaScript and PDF files concealing the malicious payload. Running the JavaScript triggers the injection of a pair of image files, which deploy PowerShell commands that result in the execution of a Windows executable that launches a Formbook-injecting malware loader.

Such a loader had been used to deliver AsyncRAT, Remcos, XWorm, and SmokeLoader. Mounting adoption of techniques for covert Formbook malware compromise should prompt security teams to bolster their monitoring of dubious archive-based email attachments, user-opened attachment-related PowerShell execution, manual DLL mapping symptoms, and anomalous DLL loading behavior, said WatchGuard researchers.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Formbook Malware Campaign Targets Organizations with Advanced Phishing Techniques Two phishing campaigns have been identified targeting organizations in Greece, Spain, Slovenia, Bosnia, Croatia, and several South American countries, aiming to deliver the Formbook infostealer malware. The first campaign employs DLL sideloading via a RAR file containing three DLLs and a Windows executable, while the second campaign uses obfuscated JavaScript and PDF files to conceal the malware payload. When executed, the JavaScript drops image files that execute PowerShell commands, ultimately launching a custom malware loader that deploys Formbook. This malware is designed to steal sensitive information, including login credentials and browser data. Formbook has been active since 2016 and continues to pose a significant threat. Security researchers from WatchGuard recommend monitoring for suspicious email attachments and anomalous system behaviors to mitigate risks. The campaigns highlight the evolving tactics used by cybercriminals to bypass detection mechanisms. 2 sources 71

Extracted Entities

Formbook infostealer deployed in clandestine phishing campaigns | brief

The full story

Extracted Entities

Attack Types (2)

Countries (4)

Malware (5)

MITRE ATT&CK (3)

Platforms (1)

Tools (1)