This threat involves two distinct phishing campaigns delivering the FormBook malware, a data-stealing trojan. The first campaign uses RAR archives containing legitimate executables that exploit DLL side-loading to load malicious DLL files. The second campaign uses heavily obfuscated JavaScript to drop encrypted PNG files, then uses Base64-encoded PowerShell scripts and a custom .NET loader named Mandark to inject the malware into the RegAsm process. The FormBook executable employs advanced evasion techniques by manually mapping ntdll.dll in memory to bypass user-mode monitoring and perform direct system calls. This enables the malware to steal credentials and browser data stealthily.

The malware enables credential theft and data collection from browsers, potentially compromising sensitive information within targeted organizations. The advanced evasion techniques reduce the likelihood of detection by common security tools, increasing the risk of prolonged undetected presence. The campaigns specifically target companies in Greece, Spain, Slovenia, Bosnia, and Central American countries, indicating focused regional targeting.

No patch or official remediation is indicated in the provided data. Organizations should focus on user awareness to prevent phishing, monitor for DLL side-loading behaviors, and detect obfuscated JavaScript and suspicious PowerShell activity. Endpoint detection and response solutions should be tuned to identify manual ntdll.dll mapping and direct syscall techniques. Since no vendor advisory or patch information is available, patch status is not yet confirmed — check vendor advisories for updates.