Daily Summary
Formbook activity surged to 100 new samples on 2026-10-11, a 312% increase over the 7-day average of 24. This is the largest single-day volume observed in the current tracking window and marks a sharp departure from the relatively steady baseline of the prior week. The spike is driven primarily by script-based droppers, with 51 .js samples accounting for over half of today’s total.
New Samples Detected
The file type distribution shows a decisive tilt toward script-based delivery. JavaScript (.js) dominates at 51 samples, followed by executables (.exe) at 18, PowerShell (.ps1) at 8, and a long tail of .com (7), .vbs (3), .vbe (3), .bin (3), .bat (2), .wsf (2), and .scr (2). The .js concentration suggests a coordinated campaign rather than opportunistic scatter, since script droppers are typically used to stage payload retrieval and evade static executable detection. The presence of .wsf and .vbe files alongside .js and .vbs points to a multi-format script delivery kit, allowing the operator to rotate extensions as filters catch up.
C2 Infrastructure
Two new C2 servers were registered today, bringing the new IOC count to 102. The low ratio of C2 servers to samples (2 servers across 100 samples) implies heavy reuse of existing infrastructure rather than a fresh build-out. This is consistent with a high-volume distribution wave riding on established backend capacity, not a new actor standing up from scratch.
7-Day Trend
Today’s count sits well above the 25% deviation threshold that would normally trigger concern. At 312% of the rolling average, this is a genuine surge rather than normal variance. The prior six days averaged roughly 24 samples per day, indicating the campaign either reactivated or escalated its distribution on 2026-10-11.
Security Analysis
The script-heavy distribution pattern contrasts with Formbook’s more traditional .exe and Office macro delivery. A 51-sample .js wave, paired with minimal new C2 infrastructure, mirrors the pattern of an established operator recycling loaders and backend while flooding a single delivery channel. Defenders who have tuned detections around executable-based Formbook samples should verify that JavaScript and WScript-based droppers are covered by current detection logic, particularly .js and .wsf execution paths. The most actionable step today is to audit endpoint logging for script host execution (wscript.exe, cscript.exe) and confirm that script-block logging and AMSI are enabled, since this campaign’s volume depends on script stages that executable-only defenses will miss.