#FormBook
LightNews LightNews
bomccss.bsky.social
引用元:
x.com/tdatwja/stat...
misaki (@tdatwja) on X
日本語マルウェアメールの接到を確認しています。 #Formbook 件名: ご教示ください ダウンロードファイル: 至急のお見積もり依頼.zip MD5（至急のお見積もり依頼.js）: 14a58fbb6422c27976bf32401f5ef593 Sample: https://t.co/xuWeoXDOH0
x.com
October 6, 2026 at 9:25 AM
bomccss.bsky.social
添付ファイルからマルウェア感染を狙った日本語のメールが確認されています。
■日時
2026/10/06(火)
■件名
ご教示ください
■添付ファイル
至急のお見積もり依頼[.]zip -> .js
www.virustotal.com/gui/file/a83...
tria.ge/261006-d8hwv...
情報窃取マルウェア #Formbook
■通信先
hxxps[:]//www.beinke-aufzuege[.]de/components/com_media/fkqabmp/ntxqre1/edfwcgi/secured_stub.ps1
October 6, 2026 at 9:25 AM
cyberalliance.bsky.social
CTA member VMRay brings a story of a hunt: how a pile of 276 Formbook samples run through a machine learning pipeline led us to a global Business Email Compromise campaign.

www.vmray.com/hunting-a-gl...
#cybersecurity #threatresearch
From One RedLine IP to a Maritime Phishing Cluster: A Threat Intelligence Pivot Chain
A single RedLine C2 from UniqueSignal pivots into a maritime spear-phishing cluster and attacker-owned infrastructure.
www.vmray.com
October 2, 2026 at 8:00 PM
bomccss.bsky.social
添付ファイルからマルウェア感染を狙った日本語のメールが確認されています。
■日時
2026/10/02(金)
■件名
御見積依頼の件
■添付ファイル
20260210_主蒸気系統用バルブ一覧表[.]zip -> .wsf
virustotal.com/gui/file/c30...
tria.ge/261002-fldpq...
情報窃取マルウェア #Formbook

同一メールの観測報告
x.com/tdatwja/stat...
October 2, 2026 at 1:49 PM
dreharrison.bsky.social
Morning catch-up thoughts (MotoGP):
- Going about as the formbook suggested: Think Ducati look a little stronger, but Bez is in range. Not entirely a bad thing if you're Marc.
- Very close all-round though. Going to come down to on the day strength.
October 2, 2026 at 11:43 AM
glitterbean.wehavecookies.social.ap.brid.gy
Formbook-Payload-Extraction-XOR-Decryption-Net-Assembly-Analysis https://kitploit.com/en/tools/github/kaandemir993/formbook-payload-extraction-xor-decryption-net-assembly-analysis
Formbook-Payload-Extraction-XOR-Decryption-Net-Assembly-Analysis — Reverse engineering analysis of Formbook, an info-stealer that uses .NET assembly manipulation and XOR decryption. Full payload extracted via x32dbg, including the XOR decryption loop, CLR initialization, SQLExpress decoy, and keylogger/clipboard APIs. | Kitploit
Reverse engineering analysis of Formbook, an info-stealer that uses .NET assembly manipulation and XOR decryption. Full payload extracted via x32dbg, including the XOR decryption loop, CLR initialization, SQLExpress decoy, and keylogger/clipboard APIs.
kitploit.com
September 30, 2026 at 9:11 PM
invokereversing.bsky.social
We've uploaded our stream from last Tuesday where we analyzed a Golang loader that uses vulnerable drivers to terminate EDR and antivirus processes before dropping Formbook. Enjoy!
Golang BYOVD Malware Loader and Vulnerable Driver Analysis (Stream - 08/09/2026)
YouTube video by Invoke RE
www.youtube.com
September 17, 2026 at 2:09 PM
amethyst.systems
New blog post: Abstracting Evasion: How a Fileless Formbook Variant Blinds Kernel Telemetry amethyst.systems/blog/posts/a... #malwareanalysis #threatintelligence #blueteam
amethyst.systems
September 2, 2026 at 6:57 AM
amethyst.systems
Another Formbook 0day payload revealed. No hits on VirusTotal for 2fbf00f062edb434958d572246ce858be4d309f87dfcaad1c3d67d0dcb758248. These guys are good at hiding their tracks. This deserves a proper write-up.
September 2, 2026 at 6:23 AM
amethyst.systems
Formbook is formiddable in its anti-forensic footprint. It self-hollows its Powershell process so that it can evade programs like Sysmon who detect process hollowing. Son of a bitch. This is why I like looking at malware man, it's endless technological wizardry.
September 1, 2026 at 8:02 AM
amethyst.systems
The worst part of malware research is waiting for the malware to detonate. I remember when I was at Palo Alto Networks we had a guy who programmed the malware analysis sandbox to hook the sleep function and make it go faster. Not reliable, but surprisingly effective. Wouldn't work for Formbook tho
September 1, 2026 at 6:11 AM
amethyst.systems
I just extracted an undetected artifact in Formbook in my lab. Gonna write up a report on the sample's anti-forensics tactics. It nasty. Total LinkedIn bait.
August 31, 2026 at 7:56 AM
yazoul-alerts.bsky.social
CVSS 9.9. Unauthenticated. Public exploit. Patch now.

This is a critical RCE in a widely deployed edge device.
No authentication required.
Exploit code is already circulating.

https://www.yazoul.net/malware/formbook-2026-08/reports/2026-08-16/

by Yazoul AI #InfoSec #ThreatIntel
August 18, 2026 at 10:30 AM
yazoul-alerts.bsky.social
792 attempts.

That's how many times attackers tried to exploit CVE-2026-8037 before CISA even added it to KEV.

https://www.yazoul.net/malware/formbook-2026-08/reports/2026-08-09/

by Yazoul AI #CyberSecurity #Security
August 10, 2026 at 4:55 PM
racingnews365.com
Charles is keen to get to the bottom of this!

#F1 #F1News #F12026

Charles Leclerc highlights perplexing Ferrari trend after Hungary letdown
Charles Leclerc highlights perplexing Ferrari trend after Hungary letdown
Charles Leclerc has addressed the contrarian formbook Ferrari has experienced over the past three rounds, with the Scuderia providing unexpected performance across the period.
racingnews365.com
July 28, 2026 at 9:06 AM
bomccss.bsky.social
■通信先
hxxps[:]//drive.google[.]com/uc?export=download&id=1cZtnLHKzPqBMPNIDSTBjBwHtZmotlbRj
hxxps[:]//drive.google[.]com/uc?export=download&id=1qnpUArqWCidHejPJJD21e1DgUjaS6Lb0
ダウンロード後、マルウェア #Formbook を実行

引用元:
x.com/tdatwja/stat...
misaki (@tdatwja) on X
日本語マルウェアメールの接到を確認しています。 件名: RFQ番号26001803：<大学名> 添付ファイル: 見積依頼番号 26001803·pdf[.]zip -> 26001803·pdf[.]js MD5: 1be01381846f57712e764d6941cccd0b Sample: https://t.co/wl3vLok7fC
x.com
July 27, 2026 at 9:46 AM
nemounruhe.bsky.social
How Norris shifted Hungary’s qualifying formbook from red to papaya
racer.com
July 26, 2026 at 3:14 AM
racerbot.bsky.social
How Norris shifted Hungary’s qualifying formbook from red to papaya
How Norris shifted Hungary’s qualifying formbook from red to papaya
How Norris shifted Hungary’s qualifying formbook from red to papaya
racer.com
July 25, 2026 at 7:53 PM
threatinsight.proofpoint.com
We reported on its functionality and observed real-world use, as well as the campaigns and malware families associated with the service.

Some details:

• Cruciferra has been delivered alongside zgRAT, AgentTesla, AsyncRAT, XLoader, XWorm, Phantom Stealer, Formbook, and Remcos.
July 20, 2026 at 4:06 PM
longtail-news.bsky.social
Feed: "RacingNews365"
By: Samuel Coop (info@racingnews365.nl) on Thursday, June 25, 2026
Liam Lawson makes 'difficult' admission over contrasting Racing Bulls fortunes
Racing Bulls has outperformed Alpine over one lap of late, but the formbook flips come race day.
racingnews365.com
June 25, 2026 at 8:19 PM
junaidsamodien.bsky.social
Liam Lawson has admitted Racing Bulls is still searching for answers after struggling to turn strong qualifying performances into the same level of race pace - RacingNews365

racingnews365.com/liam-lawson-...
Liam Lawson makes 'difficult' admission over contrasting Racing Bulls fortunes
Racing Bulls has outperformed Alpine over one lap of late, but the formbook flips come race day.
racingnews365.com
June 25, 2026 at 6:56 PM
racingnews365.com
This is something Racing Bulls needs to get on top of!

#F1 #AustrianGP 🇦🇹

Liam Lawson makes 'difficult' admission over contrasting Racing Bulls fortunes
Liam Lawson makes 'difficult' admission over contrasting Racing Bulls fortunes
Racing Bulls has outperformed Alpine over one lap of late, but the formbook flips come race day.
racingnews365.com
June 25, 2026 at 6:46 PM
narrowingthefield.bsky.social
🔀 The Royal Ascot track bias happened... it's done... the form is locked in... moaning about the bias won't change the results... so use it to your advantage and profit from what happens next... 👇

www.narrowingthefield.co.uk/ntf-badly-dr...
NTF Badly Drawn Horse Notes: 2026 Royal Ascot Edition - Narrowing The Field
Royal Ascot 2026 is now firmly in the formbook...And I think it's safe to say it was a meeting dominated in no small part...
www.narrowingthefield.co.uk
June 25, 2026 at 6:18 AM
narrowingthefield.bsky.social
🔀 BDH Notes: Royal Ascot edition...

www.narrowingthefield.co.uk/ntf-badly-dr...
NTF Badly Drawn Horse Notes: 2026 Royal Ascot Edition - Narrowing The Field
Royal Ascot 2026 is now firmly in the formbook...And I think it's safe to say it was a meeting dominated in no small part...
www.narrowingthefield.co.uk
June 24, 2026 at 6:04 AM
bomccss.bsky.social
■通信先
hxxps[:]//mail.avicennaalliedhealthinstitute[.]org/stubblassed.ps1
50.6.43[.]149:443
www.virustotal.com/gui/file/93a...
情報窃取系マルウェア #Formbook

マルウェアの取得先は以下と同一ドメイン
bsky.app/profile/bomc...

引用元:
x.com/tdatwja/stat...
June 22, 2026 at 9:53 AM