Morphisec uncovers XLoader attacks using fake purchase orders

Security researchers from Morphisec have identified a new wave of business-themed phishing campaigns delivering the XLoader infostealer, spawned from a benign-looking ordering context. The attacker emails, written in Greek, Slovenian and English, invite recipients to confirm or quote purchase orders and deliver RAR archives named after those orders.

Inside each archive, victims encounter an obfuscated JScript file that, when executed, overwrites its Zone[.]Identifier stream to strip security flags and decodes two embedded Base64 blobs. The decoded payload writes an x86 LuaJIT interpreter and a Lua file into the user’s Documents folder, then runs the LuaJIT executable in a hidden window. Researchers note that this is an in-memory loader: the LuaJIT process then decrypts the core XLoader payload across multiple RC4 passes and proceeds to injection.

The XLoader infostealer leverages a shared-section injection technique with x86 thread-context redirection, rather than traditional hollowing. After deployment, the malware targets Windows processes, creating a shared memory section and mapping views into legitimate hosts, with a bootstrap address set via the remote thread. Inside a target process, it collects credentials from web browsers and Windows Vault storage, harvests cookies, and compiles system survey data.

It communicates with its command servers over HTTP and raw sockets, and Morphisec reports decoy domains accompany the real endpoints. The campaign infrastructure also distributes other commodity malware such as Agent Tesla, Remcos and XWorm through the same delivery chain. Evidence ties the operators to commodified malware operations and suspected initial-access brokers, though no single cybercrime gang is named, and the exact number of affected organisations remains undisclosed.

Mitigation guidance from Morphisec emphasises alerting on unexpected executable launches from the Documents folder after Windows Script Host runs a JScript, detecting LuaJIT calls to memory APIs and blocking script execution from user directories via AppLocker. Email gateways should inspect compressed archives for script files and headers, while endpoint protection should monitor shared-section mapping and other anomalous process injection activity.