Daily Summary
Formbook activity dropped 16% below the seven-day average on 2026-07-19, with 45 new samples collected. A notable surge in JavaScript (.js) samples accounted for 62% of total detections, while no new C2 infrastructure was observed. The downward trend suggests a potential operation pause or shift in delivery methods.
New Samples Detected
The sample type distribution shifted sharply toward JavaScript files, which made up 28 of 45 detections (62%), a significant increase from the typical 30-40% observed over the past week. Traditional executables (.exe) represented only 3 samples, indicating a continued pivot away from binary payloads. One sample used the rarely observed .29475 extension, likely an obfuscated or renamed script file, which warrants closer analysis for potential fileless execution techniques. The presence of 5 .xlsm files alongside 3 .vbs and 2 .hta samples suggests the JS loader chain may be vetting victims before delivering the final Formbook payload.
7-Day Trend
The 16% decline from the 53-sample average does not qualify as a major deviation (threshold >25%), but the trend warrants monitoring. The past three days have averaged 42 samples, hinting at a potential downward cycle. Analysts should prepare for possible resurgence as threat actors often test defender fatigue during lulls.
IOC Highlights
All 45 samples have been parsed, yielding 45 unique file hashes with no overlapping C2 indicators. While no new C2 domains or IPs surfaced, the JS samples contain embedded URLs to intermediate stages - likely hosted on compromised WordPress sites or paste services. These should be ingested into proxy and DNS sinkhole configurations.
Security Analysis
The 62% JavaScript dominance and absence of new C2 servers suggest Formbook operators may be iterating on a loader-first approach, using JS as a reconnaissance tool before committing to C2 communication. This aligns with known campaigns where initial stages validate victim environment (detecting sandboxes or outdated AV) before dropping the final payload. Actionable recommendation: Enable script block logging and AMSI enforcement for JavaScript execution across endpoints, and deploy YARA rules targeting Formbook’s recent JS inter-stage URLs that use obfuscated WScript.Shell calls.