[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f8kN2VLhHo8CPkUzkFfZlFqc5Ine-VVfaK7BIZspXWaE":3},{"article":4,"iocs":39,"watch_terms":47,"solutions":48,"lesson":134},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"62fc0ff7-2035-4235-8dfd-35462c0d3d6f","Hackers Use Fake Purchase Order Emails to Deliver XLoader Malware Through Malicious Word Documents","hackers-use-fake-purchase-order-emails-to-deliver-xloader-malware-through-malici-fb620b","Hackers are sending fake purchase order emails to trick recipients into opening Word documents that deliver XLoader, an information-stealing malware. The attack uses an embedded document, an old Microsoft Equation Editor vulnerability, and several script stages to reach its final payload. What begins as a routine order confirmation can end with stolen browser data and […] The post Hackers Use Fake Purchase Order Emails to Deliver XLoader Malware Through Malicious Word Documents appeared first on Cyber Security News.","Hackers are conducting a phishing campaign using fake purchase order emails to distribute XLoader information-stealing malware through specially crafted Word documents. The attack exploits CVE-2017-11882 in Microsoft Equation Editor via an embedded RTF document feature (altChunk) to execute scripts that ultimately deliver XLoader v8.9 in memory with registry-based persistence. The campaign uses multiple script stages and encoding to obfuscate the malware delivery chain.","Hackers distribute XLoader malware via fake purchase order Word documents exploiting CVE-2017-11882.","https:\u002F\u002Fcybersecuritynews.com\u002Ffake-purchase-order-emails\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FHackers-Use-Fake-Purchase-Order-Emails-to-Deliver-XLoader-Malware-Through-Malicious-Word-Documents.webp","2026-11-13T14:09:51+00:00","2026-11-13T15:01:25.768947+00:00",8,[17,20],{"name":18,"type":19},"Microsoft","vendor",{"name":21,"type":22},"Microsoft Equation Editor","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":23,"icon":25,"name":26,"slug":27},null,"Malware","malware",[29,34],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",[40,43],{"type":27,"value":41,"context":42},"XLoader","Information-stealing malware, version 8.9, final payload delivered in memory",{"type":44,"value":45,"context":46},"cve","CVE-2017-11882","Microsoft Equation Editor vulnerability exploited to execute embedded VBS script",[18],{"controls":49,"vendors":130},[50,78,104],{"slug":51,"name":52,"problem":53,"products":54},"patch-management","Automated patch management","Known holes get closed in days, not months.",[55,63,71],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":72,"vendor_name":18,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":79,"name":80,"problem":81,"products":82},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[83,91,99],{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":72,"vendor_name":18,"vendor_logo":73,"product_slug":100,"product_name":101,"url":102,"description":103},"defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"slug":105,"name":106,"problem":107,"products":108},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[109,117,125],{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":72,"vendor_name":18,"vendor_logo":73,"product_slug":126,"product_name":127,"url":128,"description":129},"defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",[131],{"slug":72,"name":18,"logo_path":73,"roles":132},[133],"affected",{"slug":135,"title":136,"body":137,"framework_refs":138,"framework_notes":144},"seven-year-old-office-flaw-still-delivering-malware-via-phishing-emails","Seven-Year-Old Office Flaw Still Delivering Malware via Phishing Emails","This campaign exploits CVE-2017-11882, a critical Microsoft Equation Editor vulnerability patched in November 2017, meaning any organization running it today has gone over seven years without applying a known, critical fix. Attackers combined this unpatched flaw with a convincing fake purchase order lure, relying on users opening malicious Word documents without suspicion. The multi-stage obfuscation and in-memory execution of XLoader make the payload harder to detect once the initial document is opened. This matters because XLoader is an information stealer capable of harvesting credentials, screenshots, and clipboard data, turning a single click into a significant data breach. The incident illustrates how the combination of poor patch discipline and low user awareness multiplies risk exponentially.",[139,140,141,142,143],"CIS Control 7: Continuous Vulnerability Management (v8)","CIS Control 9: Email and Web Browser Protections (v8)","MITRE ATT&CK T1203: Exploitation for Client Execution","MITRE ATT&CK T1566.001: Spearphishing Attachment","NIS2 Article 21(2)(g)",{"NIS2 Article 21(2)(g)":145,"MITRE ATT&CK T1566.001: Spearphishing Attachment":146,"CIS Control 9: Email and Web Browser Protections (v8)":147,"MITRE ATT&CK T1203: Exploitation for Client Execution":148,"CIS Control 7: Continuous Vulnerability Management (v8)":149},"NIS2 Article 21(2)(g) mandates basic cyber hygiene and security training, which would address the user awareness gap that allowed employees to open fake purchase order attachments and trigger the exploit.","The campaign delivered the malicious RTF-embedded Word document as an email attachment disguised as a purchase order, which is the defining characteristic of this phishing sub-technique.","CIS Control 9 calls for filtering and blocking malicious email attachments at the gateway level, which would have stopped the fake purchase order document from reaching end users.","The attackers exploited CVE-2017-11882 in Microsoft Equation Editor specifically to execute code on the victim's machine when the malicious Word document was opened, matching this technique exactly.","CIS Control 7 requires organisations to continuously track and remediate known vulnerabilities; applying the 2017 Equation Editor patch would have directly prevented the initial exploitation step in this attack."]