Daily Summary
Formbook detections fell to 45 new samples today, a 31% drop from the 7-day average of 65. This continues a gradual decline observed since mid-August, though the volume remains well above the baseline seen in the spring. No new C2 infrastructure was registered, suggesting the operator is consolidating existing servers rather than expanding.
New Samples Detected
The file type distribution showed a notable shift toward script-based delivery. JavaScript accounted for 28 of 45 samples (62%), up from the typical 40-50% share seen over the past week. PowerShell scripts (5) and VBE/VBS files (4) made up another 20% combined, while traditional .exe payloads dropped to just 7 samples - the lowest count for that category in two weeks. One .com executable was also captured, an uncommon format for Formbook that may indicate an attempt to bypass filters that block more recognized extensions.
The JavaScript samples follow recent patterns: obfuscated one-liners using eval() with base64-encoded payloads, often embedded in HTML email attachments disguised as invoice or delivery notifications. However, several of today’s .js samples showed a new variable-naming scheme using random Chinese characters, diverging from the ASCII-based obfuscation seen in prior weeks.
Distribution Methods
Phishing emails remain the primary vector, but today’s delivery chain showed a shift from the typical “click to download” approach. Multiple samples were retrieved from URLs hosted on compromised WordPress sites - specifically, under /wp-content/uploads/ directories with randomized subfolder names. This suggests the operator is abusing legitimate hosting infrastructure rather than renting dedicated malicious domains, which aligns with the absence of new C2 domains registered today.
The PowerShell samples appear to have been delivered via a separate campaign using HTML smuggling - the .ps1 content was embedded in an HTML file that decoded and executed via MSHTA upon user interaction. This dual-track approach (JavaScript for email attachments, PowerShell for HTML smuggling) indicates the operation is testing which delivery method achieves better infection rates before scaling up the winner.
IOC Highlights
All 45 new samples yielded associated IOCs, primarily file hashes (MD5/SHA256) and download URLs pointing to the compromised WordPress sites. Notable IOCs include:
- Three JavaScript samples sharing a common mutex value (
FB_2026_08_CL), indicating they were generated from the same build pipeline despite different obfuscation keys - A VBE sample embedding a second-stage PowerShell command that contacts
hxxp://185.220.101.34/auth/check.php- an IP previously linked to Formbook activity in Q2 2026 - Five .js files using identical user-agent strings in their download requests, a fingerprint that can aid in hunting additional samples
7-Day Trend
Today’s 45 samples mark the third consecutive day below the 7-day average, and the decline is accelerating: Tuesday logged 61, Wednesday 58, and today 45. If this trajectory holds, tomorrow’s count could fall below 40. This is not a seasonal dip - the 7-day average itself has dropped 18% over the past week, suggesting the operator may be reducing campaign volume ahead of a retool or shifting resources to another malware family within the same underground operation.
Security Analysis
The decline in C2 registrations paired with the rise in compromised WordPress hosting points to a cost-optimization strategy. The operator is shifting from paying for new infrastructure to abusing free resources, which reduces their financial footprint but increases their exposure - smaller hosting accounts can be suspended quickly, and shared infrastructure creates correlation opportunities for takedown efforts.
The Chinese-character obfuscation in today’s JavaScript samples is worth attention. Formbook campaigns historically used English or transliterated variable names, so this change may indicate a new builder version shared across multiple threat actors, or possibly a separate operator licensing the Formbook builder under different branding. Defenders should watch for this obfuscation style appearing in other malware families over the next week.
Recommendation: Block execution of JavaScript from email attachments by default and enforce a user-education policy against enabling macros or opening .js files, as script-based delivery now constitutes 82% of Formbook’s current campaign mix. Additionally, review web gateway rules to flag downloads from WordPress installs that lack proper TLS certificates or have recent domain age under 30 days.