Breakdown: 2024 FormBook Infostealer Delivered via Multi-Stage Script Obfuscation
In November 2024, a sophisticated email campaign delivered the FormBook infostealer via a series of obfuscated scripts. Attackers distributed malicious ZIP email attachments containing an obfuscated VBS file, which initiated multiple layers of PowerShell-based deobfuscation and payload retrieval. The staged infection successfully bypassed standard detection tools by employing complex anti-analysis techniques, eventually injecting FormBook into a legitimate process and establishing command and control through a remote server. Impacts included potential credential theft, session hijacking, and risk of lateral movement within affected organizations. This incident highlights the increasing use of multi-stage script-based delivery vectors and advanced obfuscation in commodity malware campaigns. Detection challenges are heightened as attackers combine legacy script formats and cloud hosting services to evade conventional endpoint security controls and deliver persistent infostealing payloads.
Kill Chain
