Formbook Infostealer: New Payload Indicators

On 2026-11-04, ThreatFox reported 21 new samples of the Formbook infostealer. These samples, identified by various hash types, represent active payloads currently circulating. Formbook is a modular information stealer that targets sensitive user data, including credentials stored in web browsers, clipboard contents, and keystrokes.

Impact

Successful execution of these payloads may lead to the compromise of local user credentials, exfiltration of sensitive session data, and potential lateral movement or secondary malware infections within an environment.

Recommendation

• Import the provided file hashes (SHA-256 and MD5) into your endpoint detection and response (EDR) or antivirus solutions to block known malicious samples.
• Implement file integrity monitoring and endpoint scanning to identify files matching the observed Formbook hash indicators.
• Review network logs for unusual outbound traffic patterns often associated with Formbook C2 activity, such as persistent connections to unauthorized external domains.