Do Son 
Infection Chain | Image: Morphisec
At a Glance
| Malware Family | XLoader infostealer (FormBook lineage, delivered alongside an x86 LuaJIT interpreter) |
| Threat Actor | Unattributed financially motivated cybercrime actors |
| Target / Victims | Enterprises receiving commercial purchase orders in Greek, Slovenian, and English (exact victim count undisclosed) |
| Delivery Vector | Phishing emails delivering RAR archives containing obfuscated JScript files |
| Key Capabilities | Embedded LuaJIT execution, AMSI and NTDLL memory patching, shared-section thread redirection injection, browser and Windows Vault credential theft |
TL;DR
Security researchers from Morphisec observed a new wave of business-themed emails distributing the XLoader infostealer. The attack hides an x86 LuaJIT interpreter and an encoded payload inside an obfuscated JScript file. Furthermore, the LuaJIT XLoader infostealer injects itself into legitimate system processes using shared memory sections rather than traditional process hollowing.
Delivery and Attribution
The attack begins with spoofed business emails written in Greek, Slovenian, and English. In one case, attackers sent a Greek message requesting confirmation for order number 001828. Another campaign distributed Slovenian messages requesting price quotes and billing invoices. These emails carried RAR archives named after specific purchase orders. Inside each archive, victims found an obfuscated JScript file rather than a business invoice. Beyond XLoader, Morphisec observed the same campaign infrastructure delivering Agent Tesla, Remcos, and XWorm.
Confirmed attribution does not connect this campaign to a named cybercrime syndicate. However, confirmed technical links establish that the operators run commodified malware operations. Suspected attribution points to financially motivated initial access brokers selling credential theft services across underground forums. Because the phishing emails used undisclosed recipient header fields, the precise number of impacted organizations remains unconfirmed.
Infection Chain
When a user opens the archive, Windows Script Host executes the JScript file. First, the script overwrites its own Zone.Identifier stream to remove Mark-of-the-Web security flags. Next, it decodes two embedded Base64 blobs using the Microsoft XMLDOM component. The script writes an x86 LuaJIT interpreter and an extensionless Lua file into the user’s Documents folder. It then starts the LuaJIT executable in a hidden window without waiting for completion.
In-Memory Loader and API Patches
Once active, the Lua script uses the Foreign Function Interface to call native Windows APIs. The script hides the terminal console and attempts to disable security tools. Specifically, it searches Common Language Runtime memory to zero strings matching AMSI functions. It also tries to patch twelve export functions in ntdll.dll, replacing entry bytes with return and no-operation instructions. In addition, the script contains conditional persistence code that checks for a special marker before scheduling tasks every ten minutes.
Native Unpacking Sequence
Next, the Lua script decodes an embedded 382-kilobyte string by applying table substitution and Base64 routines. This step reveals an importless 32-bit portable executable image. The Lua loader allocates virtual memory and creates an execution thread inside LuaJIT. According to the Morphisec research report, “The Lua loader starts a packed PE on a thread within LuaJIT; the packer then decrypts and calls the XLoader core on that same thread.” The native packer resolves memory APIs directly from the Process Environment Block. It then decrypts the core XLoader infostealer payload using multiple RC4 decryption passes.
Command-and-Control and Data-Exfiltration Behavior
After decoding, the XLoader core prepares an injector routine to target clean Windows processes. It evaluates two potential injection paths. In one path, it searches for existing x86 processes. In the other path, it launches a suspended SysWOW64 host such as mshta.exe, cleanmgr.exe, or clip.exe. Next, the injector creates a shared section and maps views into both processes. It alters the remote thread context register to point to a bootstrap address. As Morphisec explained, “The target’s original image remains mapped. This mechanism is therefore shared-section injection with x86 thread-context redirection, rather than process hollowing.”
Credential Harvesting and Decoy Traffic
Once running inside the target process, the LuaJIT XLoader infostealer collects credentials from web browsers and Windows Vault storage. It also extracts cookies and prepares system survey records. To communicate with its command servers, the malware uses HTTP and raw socket protocols. Prior analysis by Zscaler ThreatLabz confirmed that XLoader embeds decoy domains alongside real command servers. In this sample, the malware parsed 64 hostname candidates to build 16 active endpoint records. These requests use custom parameter tags, obscuring the primary command server among benign web addresses.
Defense and Detection Guidance
Organizations can detect this attack by monitoring endpoint process ancestry. Defenders should alert when Windows Script Host launches unexpected executables from the Documents folder. Security teams should also flag instances where LuaJIT binaries call native memory allocation APIs. Furthermore, administrators can block script execution from user directories through AppLocker policies. Mail security gateways must inspect compressed archives for script files and filter emails with mismatched recipient headers. Finally, organizations must deploy endpoint behavioral protection to detect shared-section mapping between unrelated processes.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
