Daily Summary
Formbook activity surged to 71 new samples on 2026-08-09, a 38% increase over the 7-day average of 51. This marks the third consecutive day of rising volume, with today’s count the highest observed in the tracking window. The distribution profile also shifted notably, with JavaScript-based droppers dominating at 71.8% of all samples, up from a typical 40-50% share.
New Samples Detected
The file type breakdown today is heavily skewed toward script-based delivery. Of the 71 samples, 51 are .js files, 12 are .exe, 5 are .vbs, with single occurrences of .56431661, .dat, and .scr extensions. The .js-to-.exe ratio of roughly 4:1 is unusual for Formbook, which historically sees a more balanced mix between compiled binaries and scripted loaders.
Of particular interest is the single .56431661 sample. This extension is atypical and likely represents a renamed binary or an artifact of a polymorphic packer. The lone .scr file suggests a screensaver-based infection vector, a technique that has been periodically observed in Formbook campaigns but has not appeared in our tracking for the past nine days.
The predominance of .js files points to an email-delivered campaign where users are lured into opening attachments that execute embedded scripts. The .vbs samples reinforce this pattern, as both file types are commonly used in multi-stage downloader chains that fetch the final Formbook payload from remote servers.
7-Day Trend
Today’s 71 samples represent a 38% deviation from the 7-day average of 51, well above the 25% threshold that warrants flagging. The trend over the past week has been uneven: counts fluctuated between 44 and 58 from August 3 through August 6, then climbed steadily to 62 on August 8 and 71 today. This sustained upward trajectory suggests an active campaign rather than a single-day anomaly, and security teams should anticipate elevated volume for at least the next 48 to 72 hours based on historical Formbook operational patterns.
IOC Highlights
All 71 new samples have been processed into new IOCs, bringing the day’s total to 71 unique indicators. No new C2 domains or IPs were recorded today, which is notable given the sample volume increase. This suggests the campaign is reusing existing infrastructure, a behavior consistent with operators who rotate domains on a slower cadence than sample distribution. Analysts should correlate today’s file hashes against known Formbook C2 addresses already in their blocklists, as the probability of overlap is high.
Security Analysis
The sharp pivot toward JavaScript droppers combined with zero new C2 infrastructure indicates a mature, cost-optimized operation rather than an emerging threat actor. Formbook operators who maintain stable C2 are typically running long-term campaigns against known victim pools, and the script-heavy delivery suggests they are targeting environments where macro-enabled Office documents have been blocked but script execution remains permissible. This is a common post-macro mitigation shift, and it implies the threat actor is actively adapting to defensive controls.
Actionable recommendation: For environments that permit JavaScript execution via Windows Script Host, deploy application whitelisting rules that block wscript.exe and cscript.exe from launching unless invoked by a sanctioned parent process. Additionally, enable AMSI and script content logging in Microsoft Defender for Endpoint or equivalent EDR, as the .js and .vbs samples observed today all require script host execution to reach their next stage. Correlate any script host execution events with network connections to known Formbook C2 ranges, as the lack of new infrastructure today makes existing IOC matches more significant.