Top Tweets for #xLoader
#XLoader v0.6.8
👇
http://www.apartuk.]info/hpum/index.php?account=w4naf290
👇
https://t.co/IZWOmmuZsF
![JAMESWT_WT's tweet photo. #XLoader v0.6.8
👇
http://www.apartuk.]info/hpum/index.php?account=w4naf290
👇
https://t.co/IZWOmmuZsF https://t.co/A9us7UyuVk](https://pbs.twimg.com/media/HIGjmRPXcAANFoI.png)
Couple #reverseloader -> #xloader #opendir at:
http://107.175.246 .42/25/
http://89.40.31 .143/img/

ThreatLabz unmasks Xloader 8.7, the evolved successor to Formbook. Learn how its advanced obfuscation and decoy C2s bypass modern security defenses.
#Xloader #MalwareAnalysis #InfoSec #CyberSecurity #ThreatIntel #Formbook #DataTheft
https://t.co/mzq7InOXJP

#ThreatProtection #XLoader doubles down on stealth - advanced obfuscation, concealed C2 infra, and rapid mutation make it a persistent #infostealer threat, read more about Symantec's coverage: https://t.co/xtAY6bqyak
#Formbook #XLoader
001skz[.]xyz
00xwq[.]online
028sdf[.]com
033skz[.]xyz
034655858[.]com
0513sport[.]com
0853073[.]win
0934800[.]com
10thring[.]com
115pic[.]com
162361[.]com
1980sy[.]com
225clics[.]net
255allen[.]com
26gjm[.]xyz
2shengman[.]com
3016squaker[.]com
3421springdale[.]info
357961[.]com
360metaverse[.]pro
3939rusk[.]com
3dshark[.]info
3dtechmechineandspares[.]com
4217193[.]win
432421[.]com
46dgj[.]xyz
48411[.]xyz
48mpt[.]xyz
4dysp[.]com
4nvig[.]info
4sansquatre[.]com
502kdy[.]com
5155650[.]win
530dm[.]net
591apps[.]com
5t45urfgurkhgbvkhbuh[.]com
7bkj[.]com
7blogger[.]com
7vlkj[.]com
800seaspray[.]com
857371[.]com
86braith[.]com
942221[.]com
a-great-s-bank[.]zone
a3hd[.]com
aap-philippines[.]com
aaronclayton[.]com
accortovida[.]com
ace126[.]xyz
achkasov[.]team
admtrans[.]com
adna111[.]com
adorablymeboutique[.]store
adorndevelopments[.]com
aenrione[.]xyz
aeroelectricengine[.]com
affiliatemarketingprograms[.]xyz
afterhourswithtig[.]com
agespray[.]com
agromarketsquare[.]com
aichangzha[.]com
aidenb[.]tech
aikesijia[.]com
airductcleaningindianapolis[.]net
aislamientomartinez[.]com
ajuna[.]network
alaeigems[.]com
alfawaresgold[.]net
alibiaglet[.]pro
alkaramagroup[.]com
alkazemi[.]group
alkonapitkoff122[.]xyz
alkoora[.]xyz
allstargcaz[.]com
amanuensedigitale[.]com
amazonretailbrickandmotar[.]net
ambermariemusic[.]com
ammolit-plus[.]com
anahgbvw-qbvafewv[.]com
anastructuresin[.]com
andalucialocalizandolab[.]com
angeleyesevents[.]com
angelikaschindler[.]com
ankaraninoylari[.]com
ap-grading[.]com
apaspaa[.]com
aquolly[.]com
arabefacil[.]com
arcana-candles[.]com
areyoufuckingnuts[.]com
artmokeystudios[.]com
arttreeshirts[.]com
ascalar[.]com
asistencia-lene[.]com
assairazur[.]xyz
asvsin[.]com
atasteofcali[.]com
atp-cayenne[.]com
aurorarefrigeration[.]com
avielman[.]com
azxyga[.]space
b-alpha[.]global
b148tlrnd09ustnnaku2721[.]com
b2b2m4[.]xyz
bacnebuster[.]com
bagira[.]pro
baipees[.]com
bajajfinservmutualfunds[.]com
bajolars[.]com
bakshipping[.]com
bandirmakenetcati[.]com
bansity[.]com
barcepas[.]com
barnjob[.]com
batomod[.]com
batuhanasut[.]com
bdstoancau[.]info
beatanyoffers[.]com
beautysuperstore[.]online
beekeeperkit[.]com
behavioralsoluctions[.]com
benefitcarolina[.]com
bennystrom[.]com
bermacam[.]xyz
bestinvest-4-you[.]com
bettytaylorbakes[.]com
beyescase[.]com
beyondescapenh[.]com
bfcmtld[.]com
bharathjbaiju[.]com
bitbasepay[.]com
bitspace[.]one
bizzyagency[.]com
blacklatte-online[.]store
blazebunk[.]com
blazed[.]tel
bleedeasy[.]com
blemed[.]com
blissbeautyuk[.]com
blockzcoin[.]com
blogreen[.]xyz
bloonsea-surprise[.]com
blttsperma[.]quest
bodychile[.]com
bolerparts[.]com
bookletier[.]com
bootychaserlinkedbingo[.]com
bossila[.]store
bostondowntownrealestate[.]com
br85115[.]top
breatheblock[.]com
breathworkbuddha[.]com
bridgecom[.]online
brightsmilesdentaloffice[.]com
brisqo[.]online
britenseriesbooks[.]com
bruztrending[.]xyz
btgca[.]com
builditatlanta[.]com
c3g6s9ar[.]com
cahuvoa[.]xyz
cainor[.]com
camsinked[.]com
canadairontoken[.]com
cannabisconnecticut[.]net
cannonbrookes[.]online
capital-bra-info-tv[.]xyz
carbon-nots[.]com
cardenia[.]city
casinomavi46[.]com
casitadespuma[.]com
cassijohnson[.]com
cateheza[.]com
cavallitowerofficials[.]com
cbsautoplex[.]com
ccpdefender[.]com
cedypan[.]com
celebertyhelicopters[.]com
celebritycallers[.]com
celestialtransportation[.]net
centroeducacionalcaparao[.]com
cforchairs[.]com
ch95516[.]ink
chainqwe-top[.]xyz
chaletdupetitjard[.]com
changeswissmind[.]com
changingalphastrategies[.]com
chanhxebthcm[.]xyz
charlottesbestroofcompany[.]com
cheatingbabes[.]art
chengbai123[.]xyz
chinaredfox[.]com
chopaap[.]com
chosen-novels[.]com
cig-online[.]com
ciosaer[.]com
citestaccnt1631566949[.]com
citizenatsoxv[.]online
cjcutthecord2[.]com
clarissagrandiart[.]com
classiclord[.]com
classicsatthetoybox[.]com
claudiaesponda[.]com
clearlineuk[.]com
cliente-mais[.]com
clovedental[.]store
clutchitems[.]com
cm94910[.]com
cmtc-sr[.]online
cockgirls[.]com
cognitivehealth[.]foundation
coloradowagering[.]com
colorbold[.]com
com-eng[.]online
combi-tech[.]tech
commercialrewithloli[.]com
companyintel[.]holdings
completehomeprotection[.]com
conditionssuitable[.]net
consignwithride[.]com
consultingpdx[.]gallery
continiutycp[.]com
cookinggem[.]com
cornerclockssofa[.]com
corporacioncgs[.]com
correoversoi[.]quest
corsaires-studio[.]net
courtownangling[.]com
cqaswh[.]com
cr7tips[.]com
creativesdigitalacademy[.]com
creativewritingservice[.]com
creditcardsbankofferssg[.]com
crickipl[.]tech
cronamovement[.]com
crownmentality[.]com
cryptoassetmanager[.]xyz
ctroutdoors[.]pro
cuevaleisure[.]com
cukierniawz[.]com
cxz6[.]com
czxdj[.]com
dadreview[.]club
dandftrading[.]com
daniuparty[.]com
darbouazza[.]net
darkchemical[.]com
dashtesting[.]com
datashen[.]com
davidfettermd[.]com
davisbroadband[.]com
dawnusglobal[.]com
dbftresf[.]xyz
dcassorealtor[.]com
dealsforsuvsil[.]com
dealsmyweb[.]com
debbieforsenate[.]com
deltamtrading[.]com
dentalimplantnearyou-ca[.]space
dereini[.]com
deyihuicanying[.]online
diamondreelsdeal[.]com
dingba2009[.]com
dinobrindes[.]store
disrepairclaimsuk[.]com
dive[.]education
divine[.]art
djammari[.]net
djmiriam[.]com
dkotaclicks[.]com
dl-graphix[.]com
dmembutidos[.]com
docmartensargentina[.]com
dogizy[.]com
doilefoy-perigord[.]online
domain[.]idealdirectories[.]com
donwalin[.]com
doremifaonline[.]com
dougdematteidrywall[.]com
drbiorganic[.]com
dreamonetnpasumo4[.]xyz
drivelingo[.]com
drkittipat[.]com
drwbuildersco[.]com
dssolutionsltd[.]com
dubbostorage[.]online
dunamisdispatchservicellc[.]com
duncharis[.]com
dunya[.]info
dwaloofr295-so-net[.]xyz
eagjet[.]com
easysocialmediamarketing[.]com
ec-laser[.]com
eclipseconstrucciones[.]com
ecotravelway[.]com
edc10[.]com
edgar-regale[.]com
edgelordkids[.]com
edgyveggie[.]biz
edu-electronicstudent[.]com
eggkabob[.]com
elcalientemamma[.]com
electricvehicleiraq[.]com
electrocide[.]biz
elfash[.]net
elturista[.]net
elysiangp[.]com
emilyschlueter[.]com
emmygracedotcom[.]wordpress[.]com
empleobrillante[.]com
englishster[.]com
engravedeeply[.]com
epicpoolandspaofflorida[.]com
eryamanescortbayan[.]xyz
esylf4vt[.]xyz
evai[.]xyz
evianwatson[.]com
evoke-managementuk[.]com
excellglobus[.]com
exclusiveprimeservice[.]com
experienceanewwelcoming[.]com
expert-formations[.]com
f2fcomunicacion[.]com
falak-online[.]com
fanwen123[.]xyz
fasa-unikin[.]education
fdmexpress[.]com
fengxiaowangluo[.]com
ff4cu63r9[.]xyz
findyoursunlight[.]com
finlandnine[.]xyz
fireemblemconquest[.]com
firstlifehome[.]com
fishhousejo[.]com
fiveallianceapparel[.]com
fjijifisee[.]xyz
flakycloud[.]com
floetic[.]space
floor-city[.]xyz
floridaevictionslawyer[.]com
floryfab[.]com
fogijjipv[.]xyz
footairdz[.]com
football-news-now[.]pro
formation-adistance[.]com
formations-francaises-2022[.]com
foryouandme516[.]rest
fourfatcats[.]com
fourstringsjapan[.]com
frator[.]xyz
freakyhamsters[.]com
frederickamajor[.]com
freedommattersmost[.]com
frelsicycling[.]com
frituur-tpleintje[.]com
frontiermotorspaintandbody[.]net
fruitdoughnuts[.]com
fsigllc[.]com
fujitsu-mtc[.]digital
g5tgbt5pro[.]club
gadget198[.]xyz
gamefi-giveaway[.]com
gatecompanytexas[.]com
genesusballoons4you[.]com
genomicarray[.]com
getmusicheard[.]com
getmuvao[.]com
gladway[.]net
gma-honestbabyclothing[.]com
gmttechnical[.]com
goal-way[.]net
goldenn[.]store
goodbridge[.]xyz
gotbn-c01[.]com
gpklogistech[.]com
graffity-aws[.]com
grandevirada[.]com
grandservicesmecaniques[.]com
greenleaforganicmeals[.]com
groupninemed[.]com
growingki[.]com
gtdjewelry[.]com
guiadeafiliados[.]com
gumbosgeorgetown[.]com
gumbosusertown[.]com
gumrukhizmetleri[.]net
gumzj[.]com
gustavomachado[.]website
gwynrosado[.]com
gyxht[.]com
h0t-now[.]com
habenabanker[.]quest
haberinolsunmilas[.]com
hackensacksalon[.]com
halkn[.]xyz
halvorson-pickup[.]com
hamericano[.]com
handwerks-service[.]com
happilyslim[.]com
hashdiary[.]com
hautebazaar[.]net
hdmoversuae[.]com
health-pro[.]xyz
heavenlynight[.]club
hebeiyaguangkemao[.]com
heicensus[.]xyz
heinie[.]info
helgquieta[.]quest
helpfromjames[.]com
hemperek[.]net
henleygirlscricket[.]com
herbalshishaflowers[.]com
herbswoodart[.]com
heritagehousehotels[.]com
hhmc[.]info
hibedestegibasvurusu[.]xyz
highanddrygardenworks[.]com
hjlife[.]net
hnhstudios[.]com
hnkunshengjx[.]com
hnqsnszjy[.]com
holasoyadolfo[.]com
holdvfind[.]store
holdyrise[.]store
hombreobjeto[.]com
homefurnishingpros[.]club
homeremodelingleads[.]com
homestimulus[.]xyz
hopemortgage[.]team
hottubtvs[.]com
httpwwwegycancer[.]net
huagehg[.]com
humanityumbrella[.]com
hussein-turky[.]com
hydrakitten[.]com
iaminsurance[.]services
icicareers[.]com
idaaapparel[.]com
idebebtb[.]xyz
ifvideo[.]xyz
igorleonardo[.]com
igrushkishop[.]com
imgfla[.]com
implorepkluts[.]xyz
influencersbybrand[.]com
innerworldalchemy[.]com
inspiration4crypto[.]com
integratedfinancial[.]coach
integrations-304vjp1[.]xyz
integrosavings[.]com
interiorsfurnitureme[.]com
interiyamapi[.]com
internetesmipasion[.]xyz
inthekitchenshakinandbakin[.]com
into-concrete[.]xyz
iphone13[.]webcam
iranianroom[.]com
isabellechiritoiabogada[.]com
islandresiliency[.]com
itbinteractive[.]com
iteraxon[.]com
its-ourhouse[.]com
ivanmateos[.]com
iyahoo[.]club
izakgrove[.]com
jajamukasaspells[.]com
jasonbridge[.]xyz
jasonjesvita[.]com
jb-pinatas[.]myshopify[.]com
jbpinatas[.]com
jcm-iso[.]com
jdsmission[.]com
jeansouliere[.]info
jeffkstone[.]store
jewel-communication[.]com
jewelrybyjma[.]com
jobsforjabless[.]com
john-erickson[.]com
jonathonhawkins92[.]github[.]io
joysfamilypressurewashing[.]com
jsmslp[.]com
junemooncrystalco[.]com
junkremovalhelp[.]xyz
justnobleempress[.]com
kahrroba[.]com
karanasiosgeorgios[.]com
kassusalesltd[.]online
kath87uimr21[.]wpeproxy[.]com
kathcorp[.]com
katherinekispert[.]com
kathicrafts[.]com
kathykeatsinsiders[.]com
katiebmakeup[.]com
kcmorgageguy[.]com
kdetective[.]com
keencloset[.]com
keithrgordon[.]com
kenelizhiro[.]online
kerpsake[.]com
keysthatrock[.]com
kienkhop[.]online
kinemasterpro[.]pro
knjcvd[.]com
kompor-premium[.]online
koudoula[.]store
kukumiou[.]xyz
laceinturedeparis[.]com
lahamicoast[.]info
lakeforestparkinvestments[.]com
laughbarrel[.]com
launchteamatx[.]com
laurelmanorbistro[.]com
laurentmathieu[.]com
laverdadjourney[.]com
lazadanyc[.]com
lechila[.]com
leerenspeel[.]online
lem-headspa[.]com
letyoursoulcontrol[.]com
levelfivequaning[.]com
lib3sisters[.]com
lienquan-trian[.]com
lifeengenharia[.]com
lightfully[.]biz
lilsitaly[.]com
litemisens[.]com
littleluxurieswithlynn[.]com
live-thisworks[.]com
livepo188[.]net
loafladies[.]com
localagentlab[.]com
logossrls[.]com
lotsimprovements[.]com
lovemoschinoshoes[.]com
loveseaton[.]com
lovingearthbotanicals[.]com
lp-safe-keepingtoyof2[.]xyz
lucasdebatintrader[.]com
luminoza[.]online
lvjia[.]store
lychee[.]host
magicspaces[.]digital
magiskbooty[.]com
mailclic[.]digital
makaroff[.]net
makonigroup[.]com
mandelbot[.]tech
mandolinmeditations[.]com
manufacturingisac[.]com
maoeifnk[.]com
maonagrana[.]com
marcelsutedja[.]com
martialartsreigns[.]online
massanyakudachiblog[.]com
masterlotz[.]com
mawdbystyletreasure[.]net
mcdonaldsfastdel[.]xyz
mdcxdgkr[.]com
mdx-inc[.]net
medularity[.]com
medyglobalweb[.]com
megamobil[.]wien
melaniemorris[.]online
memoriasolidaria[.]com
mentllc[.]com
metamode[.]space
metaverseslots[.]net
mgm-photography[.]com
miaglam[.]com
mijndomein[.]partnerwebsitedns[.]com
mimosymas[.]com
mingyuan[.]men
miniblueheelers[.]com
mirceacuza[.]com
mizuno-trouble[.]net
mloujewelry[.]com
mobileiranian2[.]com
moonfoxflow[.]club
mostadem[.]com
movingcompanysatx[.]com
mtm1010[.]com
musicafe[.]tech
mycreativityworld[.]com
mystiagame[.]com
najahforehandart[.]com
nastymales[.]com
navientrefinancing[.]com
nevalostrecords[.]com
newmexicocarwrecklawyers[.]com
newportbrokers[.]com
newxkm[.]com
nextlevel901network[.]biz
nflgamejersey[.]store
nft2dollar[.]com
nielsqanalytics[.]com
nissimarble[.]com
nnxsk[.]com
nohohonndana[.]com
northernlightsdrivethru[.]com
nosomedayinbadass[.]com
obicit[.]com
olxsale[.]com
onestopfitnfine[.]com
oneworldeliveryc[.]services
openpatent[.]online
oshsandst[.]one
otazkystookt[.]quest
oto-kit[.]net
ouachitah[.]com
ovicbd[.]com
pa66sujiao[.]com
pacelicensedelectrician[.]com
pacobuilder[.]com
pagchapman[.]top
paghosting[.]net
palaesthetic[.]com
palinurjat[.]quest
panasonic-hcm[.]com
panorama-mercure[.]com
parspaid[.]com
paynec[.]com
pcwcouriers[.]com
peeningconsultants[.]com
peihbw[.]com
petswastepickup[.]com
pharma-gxp[.]com
phoebenfinn[.]com
picoluxasiate[.]com
picturebookoriginals[.]com
pixelfetish[.]photography
premierrofzms[.]xyz
priorityvvorkforces[.]com
proyectosmpd[.]net
qljjqq[.]com
qtih[.]top
quimicosypapelesdelnte[.]com
ragu[.]pro
randlesrice[.]com
realbeachart[.]com
reddishgomjtd[.]xyz
refreshpor[.]xyz
reklamilanlar021[.]xyz
remediationnews[.]com
resporn[.]tech
restaurantemesana[.]com
revelandlaceevents[.]com
revivesurgicals[.]xyz
riddleme[.]one
rockacaust[.]com
royalbirkdalecres[.]info
ruralconcept[.]com
sahodyafbdchapter[.]com
sailmoraira[.]online
saintgeorgeinsd[.]com
sakiyaman[.]com
saludbellezayfortaleza[.]online
sattaking-gaziabad[.]xyz
scanourcan[.]com
scarjamfam[.]com
schonheitschirurg[.]online
screenjs[.]com
scrubbingturtles[.]com
scrunchiespree[.]com
scwrdctyewfrcdqu[.]cloud
sedonachocolatesuperfoods[.]com
seetheirsmile[.]com
semhartekest[.]com
seniorhm[.]com
sevendigitslifestyle[.]com
sharpberth[.]com
shipmandesignz[.]com
shivamjhakdayoga[.]com
showgeini[.]com
shristiprintingplaces[.]com
sinterekes[.]com
sitejdfinancas[.]club
sixtyseven50[.]com
skincarefamily[.]com
skinmedic[.]club
skyzed[.]com
sofiathinks-elderly[.]net
southking[.]tech
sparkling-sunshine[.]com
staysg[.]club
stellarsweats[.]com
suhuabo[.]com
suzettedavid[.]com
synergydressage[.]com
szmrys[.]com
szvara[.]com
tapusorgula[.]com
tecnophone[.]net
tenutoai[.]com
terrierslovjt[.]xyz
theonestarstate[.]com
thepanopticgroup[.]com
tunnelvisionconference[.]com
twinsinsuranceagency[.]com
unicodeworld[.]com
unitedsafetyassociation[.]com
vcfnc[.]com
wakingthehirschfeld[.]com
withparadigm[.]com
worldcoachesnetwork[.]com
wsofy[.]com
@K_N1kolenko @abuse_ch @ET_Labs
Also at https://cstaipas\.pt/encrypt, though this one is #xloader, a fake c2 at: http://www.emberfmeadowzu\.store/jmy3/
A new approach to static analysis with AI that turns days of research into hours. No MCP or live IDA required. Using GPT-5, we completely cracked XLoader v8, one of the most challenging malware families to analyze. #XLoader #MalwareAnalysis #AI https://t.co/3wJUa6WBeH
🚨#Formbook #Xloader spotted in a malspam campaign in #Italy
⚠️Using another "Lorem Ipsum Dolores" variation!
Related tweet: https://t.co/gNq7Bg9Bv5
@anyrun_app analysis: https://t.co/nVJAypisqu
C2: www[.]grevla[.]top
![ShadowOpCode's tweet photo. 🚨#Formbook #Xloader spotted in a malspam campaign in #Italy
⚠️Using another "Lorem Ipsum Dolores" variation!
Related tweet: https://t.co/gNq7Bg9Bv5
@anyrun_app analysis: https://t.co/nVJAypisqu
C2: www[.]grevla[.]top https://t.co/64eNFjfa2C](https://pbs.twimg.com/media/G4l8Wt5WMAAW0dD.png)
first time I see #CrypterAndTools used to inject a #Formbook #xLoader
Yes Threat Actor, you're a clown, accidentally putting a line terminator is breaking your malware
Bazaar: https://t.co/Pvxc84l49J
#Steganography #Stego

#Formbook y #Xloader
Formbook busca robar información: credenciales a través de formularios web, capturas de teclado, y exfiltración de datos desde navegadores y clientes de correo electrónico. ¿Una particularidad? Su evolución en forma de XLoader, versión actualizada que amplía sus funcionalidades y cambia la estrategia de distribución.

Multi-Stage Malware Attack Uses .JSE and PowerShell to Deploy Agent Tesla and XLoader https://t.co/VhyoDFgQtV
#multistagemalware #malwareattack #JSE #PowerShell #agenttesla #XLoader #CyberSecurity #cyberattacks
@ex_raritas @malwrhunterteam @pr0xylife @executemalware @banthisguy9349 Samples from mentioned #opendir and after ps1 run
✅https://t.co/E85CkYbqrd
including 👇
#AgentTesla
#FormBook/#XLoader
#PhantomStealer
#RemCosRat
AnyRun
▶️https://t.co/GJqBwL07Aa

Last Seen Hashtags on Sotwe
cinquentonas
Seen from Brazil
dimplehayathi hot
Seen from India
DestekÜrünleri
Seen from United States
مبادل_جدة
Seen from Netherlands
mlbb #nsfw zhuxin
Seen from Philippines
หญิงขายบริการ
Seen from Thailand
gameoverse
Seen from Mexico
omnia
Seen from Brazil
人兽
Seen from Sweden
tetona
Seen from United States
Most Popular Users

Elon Musk 
@elonmusk
240.2M followers

Barack Obama 
@barackobama
119.3M followers

Donald J. Trump 
@realdonaldtrump
111.6M followers

Cristiano Ronaldo 
@cristiano
109.1M followers

Narendra Modi 
@narendramodi
107M followers

Rihanna 
@rihanna
97.3M followers

NASA 
@nasa
92.1M followers

Justin Bieber 
@justinbieber
90.6M followers

KATY PERRY 
@katyperry
86.9M followers

Taylor Swift 
@taylorswift13
80.7M followers

Lady Gaga 
@ladygaga
72.3M followers

Kim Kardashian 
@kimkardashian
69.4M followers

Virat Kohli 
@imvkohli
68.7M followers

YouTube 
@youtube
68.6M followers

Bill Gates 
@billgates
63.5M followers

The Ellen Show
@theellenshow
62.5M followers

CNN 
@cnn
61.9M followers

Neymar Jr 
@neymarjr
61.2M followers

X 
@x
60.9M followers

Selena Gomez 
@selenagomez
60M followers

![JAMESWT_WT's tweet photo. #XLoader v0.6.8
👇
http://www.apartuk.]info/hpum/index.php?account=w4naf290
👇
https://t.co/IZWOmmuZsF https://t.co/A9us7UyuVk](https://pbs.twimg.com/media/HIGjlzkXIAAS3KC.png)


![JAMESWT_WT's tweet photo. "Urgente: Conferma dell'indirizzo richiesta per l'elaborazione dellaspedizione"
#formbook #xloader
drop
⚠️https://files.catbox.]moe/swbtdq.ps1
Samples + dropped
https://t.co/RTtlJIM9Rq
AnyRun
https://t.co/qVXYwFPH7M https://t.co/5AjXFbEous](https://pbs.twimg.com/media/HGcDPqCWgAA8WtV.png)
![JAMESWT_WT's tweet photo. "Urgente: Conferma dell'indirizzo richiesta per l'elaborazione dellaspedizione"
#formbook #xloader
drop
⚠️https://files.catbox.]moe/swbtdq.ps1
Samples + dropped
https://t.co/RTtlJIM9Rq
AnyRun
https://t.co/qVXYwFPH7M https://t.co/5AjXFbEous](https://pbs.twimg.com/media/HGcCGvoXsAAcUT_.jpg)




![JAMESWT_WT's tweet photo. #FormBook #XLoader from spam email italy
Samples👇
https://t.co/xD71KUALDw
https://t.co/Uke32HhsAo
⬇️
www.xg66s.]sbs
www.maxbotfinance.]ru
www.bodyritualz.]com https://t.co/191HbkuZIz](https://pbs.twimg.com/media/HFSJ-c_a0AAPnN9.png)
![JAMESWT_WT's tweet photo. #FormBook #XLoader from spam email italy
Samples👇
https://t.co/xD71KUALDw
https://t.co/Uke32HhsAo
⬇️
www.xg66s.]sbs
www.maxbotfinance.]ru
www.bodyritualz.]com https://t.co/191HbkuZIz](https://pbs.twimg.com/media/HFSJ-OMbAAAsi3i.png)






![ShadowOpCode's tweet photo. 🚨#Formbook #Xloader spotted in a malspam campaign in #Italy
⚠️Using another "Lorem Ipsum Dolores" variation!
Related tweet: https://t.co/gNq7Bg9Bv5
@anyrun_app analysis: https://t.co/nVJAypisqu
C2: www[.]grevla[.]top https://t.co/64eNFjfa2C](https://pbs.twimg.com/media/G4l8WrwWIAAef75.jpg)
![ShadowOpCode's tweet photo. 🚨#Formbook #Xloader spotted in a malspam campaign in #Italy
⚠️Using another "Lorem Ipsum Dolores" variation!
Related tweet: https://t.co/gNq7Bg9Bv5
@anyrun_app analysis: https://t.co/nVJAypisqu
C2: www[.]grevla[.]top https://t.co/64eNFjfa2C](https://pbs.twimg.com/media/G4l8WqSWoAA5Twt.jpg)
![ShadowOpCode's tweet photo. 🚨#Formbook #Xloader spotted in a malspam campaign in #Italy
⚠️Using another "Lorem Ipsum Dolores" variation!
Related tweet: https://t.co/gNq7Bg9Bv5
@anyrun_app analysis: https://t.co/nVJAypisqu
C2: www[.]grevla[.]top https://t.co/64eNFjfa2C](https://pbs.twimg.com/media/G4l8WoOWYAAxzUN.jpg)








