FormBook and XLoader: The Decade-Old Form-Grabber That Won’t Quit

FormBook is a Windows information stealer and form-grabber sold as crimeware-as-a-service since 2016. Around February 2020 it was relaunched on underground forums as XLoader, which added cross-platform capability including a macOS build. MITRE ATT&CK tracks the two together as S1207 and dates the family to at least 2016. Its low price and hosted command-and-control panel make it accessible to low-skill actors, which keeps it among the most prevalent commodity stealers — it topped Check Point’s monthly Global Threat Index in August 2021 and again in August 2022.

Overview & MaaS Model

FormBook is sold pre-compiled with a hosted web panel. Pricing has been reported at point-in-time figures that vary by source and build — BlackBerry cited roughly $29 for a week up to $299 for a full license on Windows, while the macOS XLoader build was reported at around $49 per month or $99 per quarter (Check Point, 2021) and later near $199 per month (SentinelOne, 2023). Authorship of the XLoader revamp has not been firmly tied to FormBook’s original developer; treat the link as an open question. There is no single operator — it is a commodity tool used by many unrelated phishing actors.

Timeline

• 2016. FormBook first seen on Windows.
• Feb 2020. Reappears and rebrands on forums as XLoader.
• Oct 2020 – Jul 2021. macOS XLoader variant documented; early builds were Java.
• Aug 2021 & Aug 2022. FormBook ranks first in Check Point’s Global Threat Index.
• Aug 2023. A new macOS build dropped the Java dependency, rewritten in C/Objective-C and signed with a since-revoked Apple developer ID, disguised as “OfficeNote” (SentinelOne).

Technical Capabilities

• Form grabbing — harvesting data submitted into web forms — plus keylogging, clipboard capture and screenshots. T1056.001 T1113
• Credential theft from a broad set of applications; BlackBerry cites support for more than 90 programs including browsers, email and FTP clients.
• macOS builds focus on clipboard and browser data (Chrome and Firefox in the OfficeNote build).

Delivery

Delivery is primarily phishing email with malicious attachments; the Windows default configuration has been reported to use a self-extracting RAR with an embedded AutoIt script. The macOS build was rented as a service, delivered early as a Java archive and later as a signed DMG posing as productivity software. T1566.001

MITRE ATT&CK Mapping (S1207)

Detection & Mitigation

• Scan and restrict email attachments — self-extracting RARs, AutoIt scripts and macro-enabled Office files.
• EDR rules for process hollowing and APC-queue injection into signed system binaries.
• On macOS, enforce Gatekeeper and notarization and alert on LaunchAgent creation by a freshly mounted DMG.
• Treat any infection as credential compromise: rotate and invalidate sessions.