Daily Summary
Formbook activity rose to 100 new samples on 2026-11-08, a 51% increase over the 7-day average of 66 and the highest single-day count in the current window. This is a notable day driven by script-based delivery rather than executable volume, with .js files (41) now the dominant format. The jump warrants attention but does not yet indicate a sustained surge until confirmed over the next 48 hours.
New Samples Detected
The file-type mix shifted decisively toward script interpreters. Script formats (.js, .ps1, .wsf, .vbe, .bat) account for 62 of 100 samples, while native executables (.exe plus the doubled-extension .exe$ variants) account for 30. The .exe$ entries (3) are a mild evasion signal, likely double-extension masquerading. One .msg sample stands out: Outlook message files are an uncommon Formbook delivery container and typically indicate email-borne attachment campaigns rather than web delivery. The single .att (commonly seen in groupware/mail archiving) reinforces that read.
Distribution Methods
The heavy .js and PowerShell presence, combined with the .msg and .att files, points to an email phishing cluster using archive and message attachments that unpack to script loaders. This differs from Formbook’s typical pattern of Excel/Word droppers or direct .exe lures. The .wsf and .vbe additions show the operator maintaining multiple script runtimes, a common tactic to raise the odds of at least one living-off-the-land execution path surviving user filters.
C2 Infrastructure
Only one new C2 server was registered despite the sample surge, yielding 101 new IOCs. The high IOC-to-C2 ratio (roughly 100 IOCs per server) suggests a shared panel with many per-sample URI paths, config blobs, and gate URLs pointing at a single backend. That is consistent with a single actor or affiliate batch-pushing samples overnight rather than a coordinated multi-operator campaign.
Geographic Distribution
No country attribution was available for today’s batch, so no geographic analysis is possible. Distribution appears to be spread through generic phishing infrastructure rather than region-targeted.
7-Day Trend
At 51% above the 7-day average, today’s count clears the 25% deviation threshold. The rise is concentrated in script files rather than the executable baseline, so treat it as a delivery-method spike rather than a broad increase in overall campaign tempo.
Security Analysis
The combination of a 51% sample surge against a single new C2 server is the most telling signal here. Known Formbook affiliate batches typically scale C2 alongside volume; a one-to-one hundred ratio instead resembles bulk re-packing of a single config against many lure variants. Analysts should not treat today’s 101 IOCs as 101 independent indicators: cluster them by shared gate URL or panel host, and prioritize blocking the new C2 and its URI patterns over enumerating individual samples. Defensively, given the .msg/.att/.js mix, tune mail gateways to quarantine messages whose attachments chain to script interpreters, and add detection for double-extension execution (.exe$) at the endpoint. Monitor the next two days to confirm whether the script-heavy delivery persists or reverts to the executable baseline.
IOC Highlights
The 101 new IOCs are dominated by per-sample URI paths, config blobs, and gate URLs tied to the single new C2 server, plus the three .exe$ double-extension artifacts and the .msg/.att mail containers. Prioritize the C2 host and its URI patterns; individual hashes are likely to rotate quickly.