Agent Tesla and Formbook (now sold as XLoader) are cheap, rented credential stealers that arrive as invoice and shipping attachments, and every infection should be treated as a credential compromise, not just a malware clean-up. CISA and the Australian Cyber Security Centre listed both in their 2021 Top Malware Strains advisory, and both remain staples of phishing campaigns aimed at businesses. This guide covers names and lineage, who uses them and why, ATT&CK v20 techniques, how stolen browser, mail and FTP credentials are abused, and the detections and controls that stop them. It is written for email security, endpoint and SOC teams, and it stays at behaviour level with no code, indicators or configuration details. For the keystroke capture side in general, see the Keyloggers Guide.
Key takeaways
- They are services, not groups. Many unrelated criminals buy access, so the families tell you what was stolen, not who stole it or what they will do next.
- The attachment is the battleground. CISA and ACSC describe both as usually delivered as phishing email attachments: archives, disk images, macro documents and exploit documents.
- Saved passwords are the prize. Both families take credentials stored in browsers, mail clients and FTP clients, and both log keystrokes and clipboard content.
- Signatures age fast. Zscaler documents layered encryption, private copies of system libraries and injection into trusted processes in XLoader 6 and 7, so behaviour detection matters more than hashes.
- Response means resetting identities. Every credential and session on an infected host must be assumed stolen: reset passwords, revoke tokens and check where they were used.
Who they are (names and aliases)
Neither family maps to a single threat actor. MITRE ATT&CK tracks them as software, and CISA and ACSC described them as malware strains used by many cyber criminals.
| Name or ID | Source | What it refers to |
|---|---|---|
| Agent Tesla (S0331) | MITRE ATT&CK; CISA/ACSC AA22-216A | Spyware trojan written for .NET, observed since at least 2014; CISA classes it as a remote access trojan |
| Formbook | CISA/ACSC AA22-216A; Mandiant (2017) | Information stealer active since at least 2016, advertised on hacking forums with a panel sold and executables generated as a service |
| XLoader (S1207) | MITRE ATT&CK; Zscaler; Check Point | Malware as a Service successor to Formbook, rebranded in early 2020 according to Zscaler; ATT&CK lists Formbook as an alias |
| XLoader for macOS | Check Point | Check Point published analysis of a macOS variant in July 2021 |
Check Point reports that the Formbook author stopped sales abruptly and that XLoader filled the gap, with Formbook 4.1 the last version seen in 2020. Vendors still label detections with either name (Zscaler uses both Win32.PWS.Xloader and Win32.PWS.Formbook), so search both when hunting. No source read for this page names the developers; this page names none. See the Infostealer Threat Guide for the wider stealer market.
Targeting and motivation
- Motivation: financial. Stolen credentials are sold, used for business email compromise and fraud, or used to stage further intrusions.
- Breadth: campaigns are mostly opportunistic. Mandiant's 2017 Formbook analysis saw aerospace and defence contractors as the top target of one wave, mainly in the US, and manufacturing in South Korea and the US for another.
- Lures: purchase orders, invoices, payment confirmations, requests for quotation and parcel notifications. These themes hit finance, procurement and logistics inboxes hardest.
- Low barrier: Mandiant cited ease of use and low cost as reasons Formbook appealed to low-skill actors. That also explains the volume defenders see.
- Who should care: any organisation that lets staff save passwords in browsers or mail clients, or whose suppliers do: a supplier's stolen mailbox becomes a trusted sender for the next lure.
Tactics and techniques (MITRE ATT&CK)
All IDs below are ATT&CK v20 entries recorded against S0331 or S1207 unless noted. Defence impairment now sits under tactic TA0112 Defense Impairment.
| Tactic | Technique | Family | Primary defence |
|---|---|---|---|
| Initial access | T1566.001 Spearphishing Attachment | Both | Attachment sandboxing; block risky file types |
| Execution | T1204.002 Malicious File; T1203 Exploitation for Client Execution | Both | Mark-of-the-Web, macro blocking, Office patching |
| Persistence | T1547.001 Registry Run Keys / Startup Folder; T1053.005 Scheduled Task | Both | Alert on new Run keys and tasks from user-writable paths |
| Stealth | T1055.012 Process Hollowing; T1218.009 Regsvcs/Regasm (Agent Tesla) | Both | EDR injection and LOLBin rules; attack surface reduction |
| Credential access | T1555.003 Credentials from Web Browsers; T1552.001 Credentials In Files | Both | No saved passwords in browsers; enterprise password manager |
| Credential access | T1539 Steal Web Session Cookie | XLoader | Token binding, short session lifetimes, revoke on infection |
| Collection | T1056.001 Keylogging; T1115 Clipboard Data; T1113 Screen Capture; T1185 Browser Session Hijacking | Both | Phishing-resistant MFA so captured passwords alone fail |
| Discovery | T1016.002 Wi-Fi Discovery | Agent Tesla | WPA2/3-Enterprise rather than shared Wi-Fi keys |
| Exfiltration | T1071.003 Mail Protocols; T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol | Agent Tesla | Block direct outbound SMTP and FTP from endpoints |
| Defence impairment | T1685 Disable or Modify Tools | Both | Tamper protection on endpoint agents |
CISA and ACSC note that Formbook's developers add exploits for newer flaws, naming CVE-2021-40444 (Microsoft MSHTML), which is in the CISA KEV catalog. Older Office flaws such as CVE-2017-11882 are also KEV listed and still turn up in lures, so patch levels on Office matter years after release.
How they abuse identities and credentials
These families are identity theft tools. What they take determines the blast radius, and much of it is not a human login.
- Browser-saved passwords: corporate SaaS, VPN portals and admin consoles saved in a browser leave the host in one batch. The Snowflake breach showed what stolen stealer credentials do against accounts without MFA, although the families named there were other stealers.
- Mail and FTP client credentials: stored SMTP, IMAP and FTP passwords are often shared service credentials for a website, a supplier portal or a file drop. These are non-human credentials with no MFA and no owner. See the Human vs Non-Human Identity.
- Mailbox takeover: a stolen mailbox password is reused to send the next wave of lures from a trusted address, the classic route into business email compromise.
- Session cookies: XLoader's cookie theft can let an attacker replay a live session and skip MFA entirely. See the Infostealer Logs and Session Token Abuse Guide.
- Wi-Fi keys: Malwarebytes reported Agent Tesla variants taking saved Wi-Fi profile passwords; the purpose was not confirmed, but a shared pre-shared key is now known to an outsider.
- Developer and admin hosts: an infection on an admin or developer workstation can expose cloud consoles, API keys in files and password vault sessions.
Notable incidents
| Date | Event | Source |
|---|---|---|
| 2014 | Agent Tesla first observed | MITRE ATT&CK; CISA/ACSC |
| 2016 | Formbook advertised on hacking forums | Mandiant; CISA/ACSC |
| July to August 2017 | Formbook campaigns via PDF links, macro documents and archives against aerospace, defence and manufacturing | Mandiant |
| Early 2020 | Formbook rebranded as XLoader | Zscaler; Check Point |
| March to April 2020 | Agent Tesla spam campaigns using ZIP, CAB, MSI, IMG and Office files, adding Wi-Fi password theft | Malwarebytes |
| July 2021 | XLoader for macOS analysed | Check Point |
| 4 August 2022 | CISA and ACSC name both among the top malware strains of 2021 | AA22-216A |
| January 2025 | Analysis of XLoader versions 6 and 7 with heavier encryption and evasion | Zscaler ThreatLabz |
No coordinated law enforcement takedown of either family is recorded in the sources read for this page. Stealers disrupted in later operations are covered in the Infostealer Threat Guide.
Detection and defence
What to monitor
| Signal | Data source | Why it matters |
|---|---|---|
| Office, PDF reader or archive tool spawning scripts or unsigned executables | EDR process events; Sysmon Event ID 1 | Typical first-stage chain from an attachment |
| Executables launched from mounted ISO or IMG files or from archive temp folders | EDR; Windows Security Event ID 4688 with command line | Disk images were used to dodge Mark-of-the-Web |
| Non-browser process reading browser credential stores | EDR file access telemetry | Core stealer behaviour, regardless of family |
| Injection into explorer.exe or signed Windows binaries | EDR; Sysmon Event IDs 8 and 10 | Both families hide inside trusted processes |
| Endpoint making direct SMTP (25, 465, 587) or FTP (21) connections | Firewall and proxy logs | Agent Tesla exfiltrates by mail and FTP |
| New Run keys or scheduled tasks pointing at user profile paths | Sysmon Event IDs 12 and 13; Event ID 4698 | Common persistence for both |
| Logins with the user's credentials from new devices or locations after an alert | Identity provider sign-in logs | Shows the stolen data is being used |
Phased response plan
- Close the delivery routes: block or quarantine executable content, disk images and macro documents from external mail; sandbox remaining attachments. See the Email Security Guide and the Office Macro Blocking Guide.
- Remove the loot: disable browser password saving by policy (Chrome and Edge both offer a PasswordManagerEnabled policy) and move users to an enterprise password manager. Pilot with one department, communicate first, and keep an export window before switching off.
- Harden endpoints: turn on Microsoft Defender attack surface reduction rules that block Office apps from creating child processes and executable content from email, in audit mode for two weeks, then block. Roll back per rule if a business macro breaks.
- Block egress: deny outbound SMTP and FTP from workstations at the firewall, allowing only mail relays and named servers.
- Raise the identity bar: phishing-resistant MFA on email, VPN and admin portals, so a captured password alone fails. Shorten session lifetimes for high-value apps.
- Respond as an identity incident: on detection, isolate the host, reset every credential that could have been stored or typed on it, revoke sessions and tokens, and review sign-ins. See the Infostealer Logs Monitoring and Response Guide.
Decision guidance
- Small organisations: mail filtering with attachment sandboxing, disabling browser password saving and MFA on email give most of the benefit. Reimage rather than clean an infected laptop.
- Large organisations: add behaviour rules in EDR, egress controls, automated session revocation tied to EDR alerts, and monitoring for corporate domains in stealer log feeds.
- Clean or rebuild: because both families download second-stage payloads, rebuild the host when in doubt. Credential resets are needed either way.
Metrics
- Percentage of malicious attachments stopped before delivery (from mail filter reports).
- Percentage of managed browsers with password saving disabled.
- Median time from stealer alert to full credential reset and session revocation.
- Number of workstations able to make direct outbound SMTP or FTP connections (target zero).
- Percentage of users on phishing-resistant MFA for email and remote access.
Framework mapping
| Control area | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 |
|---|---|---|
| Malicious code protection on mail and endpoints | SI-3, SI-8 | DE.CM-09 |
| MFA and authenticator management | IA-2(1), IA-5 | PR.AA-03 |
| Boundary protection for egress | SC-7 | PR.IR-01 |
| Patching Office and browsers | SI-2 | PR.PS-02 |
| Awareness training on attachment lures | AT-2 | PR.AT-01 |
| Incident handling including credential reset | IR-4 | RS.MA-01 |
Common failure patterns
- Cleaning the host and stopping there: the credentials were gone before the alert fired; without resets the attacker keeps access.
- Forgetting non-human credentials: FTP, SMTP and website passwords saved in clients are reset last or never, because nobody owns them.
- Trusting supplier mail: lures from a compromised supplier mailbox pass reputation checks and get opened.
- Allowing disk images and archives with executables: ISO, IMG and password-protected archives slip past content inspection.
- Hash-only detection: repacked builds change constantly; behaviour rules are needed.
Practitioner checklist
- Block executables, disk images and macro documents from external email; sandbox the rest.
- Disable browser password saving and provide an enterprise password manager.
- Enable attack surface reduction rules for Office child processes and email executables.
- Patch Office and MSHTML flaws listed in the CISA KEV catalog.
- Deny direct outbound SMTP and FTP from workstations.
- Enforce phishing-resistant MFA on email, VPN and admin portals.
- On any detection, reset all stored and typed credentials and revoke sessions.
- Inventory and rotate shared mail, FTP and portal credentials saved on endpoints.
- Hunt for both family names (Formbook and XLoader) in EDR and mail filter data.
Standards and references
- CISA and ACSC: 2021 Top Malware Strains (AA22-216A)
- MITRE ATT&CK: Agent Tesla (S0331)
- MITRE ATT&CK: XLoader (S1207)
- CISA: Known Exploited Vulnerabilities Catalog
- Mandiant (Google Cloud): Formbook Malware Distribution Campaigns
- Zscaler ThreatLabz: Technical Analysis of Xloader Versions 6 and 7
- Check Point Research: XLoader Botnet, Find Me If You Can
- Malwarebytes: New AgentTesla Variant Steals Wi-Fi Credentials
Related NHI Mgmt Group resources: Keyloggers Guide · Infostealer Threat Guide · Malware Loaders and Droppers Guide · Top 10 Email Security Threats · Latrodectus and Bumblebee Loaders Guide