MalwareNov 13, 2026

Hackers Use Fake Purchase Order Emails to Deliver XLoader Malware Through Malicious Word Documents

Hackers distribute XLoader malware via fake purchase order Word documents exploiting CVE-2017-11882.

Hackers are conducting a phishing campaign using fake purchase order emails to distribute XLoader information-stealing malware through specially crafted Word documents. The attack exploits CVE-2017-11882 in Microsoft Equation Editor via an embedded RTF document feature (altChunk) to execute scripts that ultimately deliver XLoader v8.9 in memory with registry-based persistence. The campaign uses multiple script stages and encoding to obfuscate the malware delivery chain.

AI summary of the linked source. Not reviewed by an editor. How this works

Read at source

Vendor Watch

Run Microsoft?

Get an email when a new story names Microsoft, usually within the hour.

Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch works Privacy

The lesson from this incident

Full lesson

This campaign exploits CVE-2017-11882, a critical Microsoft Equation Editor vulnerability patched in November 2017, meaning any organization running it today has gone over seven years without applying a known, critical fix. Attackers combined this unpatched flaw with a convincing fake purchase order lure, relying on users opening malicious Word documents without suspicion. The multi-stage obfuscation and in-memory execution of XLoader make the payload harder to detect once the initial document is opened. This matters because XLoader is an information stealer capable of harvesting credentials, screenshots, and clipboard data, turning a single click into a significant data breach. The incident illustrates how the combination of poor patch discipline and low user awareness multiplies risk exponentially.

What helps against this

How we list vendors

Microsoft affected

Automated patch management
Known holes get closed in days, not months.
For exampleManageEngine Patch Manager Plus Ivanti Neurons for Patch Management Microsoft Intune all options
Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
For exampleBitdefender GravityZone Huntress Managed EDR Microsoft Defender for Endpoint all options
Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
For exampleProofpoint Core Email Protection Abnormal AI Abnormal Inbound Email Security Microsoft Defender for Office 365 all options

Indicators of Compromise

Extracted by AI from the linked source. Not reviewed by an editor. How this works

malware — XLoader
cve — CVE-2017-11882

Entities

Microsoft (vendor)Microsoft Equation Editor (technology)