Hackers Use Fake Purchase Order Emails to Deliver XLoader Malware Through Malicious Word Documents

Hackers are sending fake purchase order emails to trick recipients into opening Word documents that deliver XLoader, an information-stealing malware.

The attack uses an embedded document, an old Microsoft Equation Editor vulnerability, and several script stages to reach its final payload. What begins as a routine order confirmation can end with stolen browser data and additional malware on an infected computer.

The lure fits everyday purchasing workflows, asking recipients to review prices, quantities, and shipping arrangements. Similar fake business order emails have delivered XLoader through script attachments, but this case uses a DOCX file to hide the next stage.

The familiar business language gives employees a reason to open the attachment without questioning its contents. Researchers from ASEC identified the phishing activity and described the infection chain in a November 12 report.

Their technical analysis of the campaign shows how a Word attachment leads to script execution, registry-based persistence, and an encrypted payload that ultimately runs in memory. The final malware is XLoader, with version information showing release 8.9.

Hackers Use Fake Purchase Order Emails

The sample email presents an order worth $144,744.50 and asks for shipment by the end of the following month. It tells the recipient to report pricing or quantity discrepancies before shipping.

These details create a believable reason to inspect the attached purchase order while keeping attention on the supposed transaction rather than the document’s safety.

Opening the attachment starts a chain inside Word. The DOCX contains a malicious Rich Text Format document, which Word processes through its “Import Content from Another Document” feature, known as altChunk.

This feature provides the route into the embedded content; the code execution step then relies on CVE-2017-11882 in Microsoft Equation Editor.

While Word processes the RTF content, an embedded Object Linking and Embedding package writes a Visual Basic Script file into the temporary directory.

A separate Equation Editor object exploits the vulnerability to execute that script through Windows Script Host. Earlier Equation Editor exploitation campaigns also used order-themed documents to distribute XLoader, although their filenames and delivery stages differed.

The script contains Base64-encoded data, saves it locally, and launches an embedded first-stage PowerShell script. After decoding, the data contains three parts: a loader, an encrypted payload, and a second PowerShell script.

This layered packaging places multiple execution steps between the original document and XLoader, rather than exposing the final malware directly inside the visible purchase order.

Registry Persistence and In-Memory XLoader Execution

The first PowerShell stage stores its execution path and script content in separate registry values. It also creates a current-user Run entry, allowing the stored script to execute again when the user signs in.

This persistence mechanism means the attack does not depend solely on keeping the original Word document open after the initial compromise.

Next, the first script decrypts the saved data and starts the secondary PowerShell stage. That script runs the loader and passes the encrypted payload as an argument.

The loader applies an XOR operation to recover the payload and execute it in memory. Separate reporting on XLoader malware evasion techniques describes the family’s wider use of encryption and hidden communications, but those details should not be assumed for this sample.

ASEC identifies the final payload as an information stealer that collects computer details and browser data. It can also download additional malware, extending the risk beyond the first infection.

The report does not name a threat actor, establish how many organizations received the emails, or confirm the total number of compromised systems.

Defenders should verify unexpected purchase orders through a known contact and keep Office installations patched. Monitoring should connect suspicious document activity with script execution and registry changes, rather than treating each event separately.

ASEC advises checking sender domains and attachments carefully. For this chain, the document-to-script transition and logon persistence provide useful investigation points alongside the published indicators.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context on the latest threats to stop incidents quickly -> Integrate Threat Intel from 16K SOCs

The post Hackers Use Fake Purchase Order Emails to Deliver XLoader Malware Through Malicious Word Documents appeared first on Cyber Security News.