XLoader Malware Delivered via Purchase Order Confirmation Phishing Using Embedded DOCX and RTF Exploiting CVE-2017-11882
Attackers are distributing XLoader malware through phishing emails mimicking purchase order confirmations, embedding malicious DOCX files containing RTF payloads that exploit the Windows Equation Editor vulnerability CVE-2017-11882. The infection chain leverages Word's altChunk feature to import malicious content and uses an OLE object to drop a VBScript that executes in a vulnerable Office environment, bypassing reliance on macros. The VBScript launches PowerShell scripts that establish persistence via registry keys and decrypt and execute the XLoader payload in memory. XLoader steals system and browser data and downloads additional malware, with communications to the reported C2 domain hxxp://www.dumbsplash[.]com/ilto/. This multifaceted attack requires unpatched Office components and victim interaction opening the DOCX attachment. Organizations should prioritize patching Equation Editor vulnerabilities and monitor related registry and scripting artifacts indicated by the attack chain. This attack echoes a similar 2025 campaign by ASEC involving XLoader and the same vulnerability but does not confirm shared threat actors.
Entenda a falha
A vulnerabilidade
CVE-2017-11882 is a flaw in the Equation Editor component of Microsoft Office. The articles do not describe the bug type or list affected and fixed versions, only that unpatched Office with a vulnerable Equation Editor is at risk. The attacker needs no authentication or macros. The victim only has to open a malicious DOCX attachment, and the exploit then runs a VBScript on the system. Here the flaw is used to deliver the XLoader infostealer.
Como funciona
A phishing email posing as a purchase order confirmation carries a DOCX file. Word uses its altChunk feature (Import Content from Another Document) to process an embedded RTF. An OLE object in it drops a VBScript into the temp folder, and another embedded object triggers the Equation Editor flaw to run that script through cmd.exe and Windows Script Host. The VBScript writes Base64 data to disk and starts a PowerShell script. That script sets up persistence in registry keys, decrypts the data, and a loader decrypts and runs XLoader in memory.
Por que é vulnerável
The articles do not explain the root cause of CVE-2017-11882. What they show is why the attack works: the chain depends on exploiting an unpatched Equation Editor still present in Office, not on getting the victim to enable macros. The fix is to apply Office security updates and remove vulnerable Equation Editor installations.
Como foi descoberta
Researchers at the AhnLab Security Intelligence Center (ASEC) identified this infection chain, which combines embedded documents, the Equation Editor flaw, VBScript and PowerShell to deliver XLoader. It was found as an active campaign in the wild. The technique echoes an April 2025 ASEC investigation involving purchase confirmation emails, DOCX and RTF documents and the same flaw. That earlier chain used HorusProtector and Client.vbe, and the articles do not establish that the same operator is behind both campaigns.
PoC existente, privada
O exploit existe, mas quem o tem não o publicou.
The articles report a working exploit of CVE-2017-11882 used in real attacks, embedded in the malicious DOCX and RTF files that lead to XLoader. No public proof of concept or repository is cited, so access is treated as private. Because the exploit is already in active use, unpatched Office systems should be treated as urgent to fix.
Explicação gerada por IA a partir da matéria e dos artigos, em 13/11/2026 08:16.
Exploit público
Há código de exploração publicado no Exploit-DB para CVE-2017-11882. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.
-
Microsoft Office - OLE Remote Code Execution
This tool builds a malicious RTF document exploiting CVE-2017-11882, a memory corruption bug in the Equation Editor component of unpatched Microsoft Office. The victim only has to open the file; the attacker needs no authentication. Embedded OLE objects run commands in sequence: one starts the Windows WebClient service, then another launches an executable hosted on an attacker-controlled WebDAV share, bypassing the command length limit. It looks like a working exploit that genuinely targets the listed CVE.
Linha do tempo
-
XLoader Malware Delivered via Purchase Order Confirmation Phishing Using Embedded DOCX and RTF Exploiting CVE-2017-11882
ler a análise desta fonte ocultar
Attackers are distributing XLoader malware through phishing emails mimicking purchase order confirmations, embedding malicious DOCX files containing RTF payloads that exploit the Windows Equation Editor vulnerability CVE-2017-11882. The infection chain leverages Word's altChunk feature to import malicious content and uses an OLE object to drop a VBScript that executes in a vulnerable Office environment, bypassing reliance on macros. The VBScript launches PowerShell scripts that establish persistence via registry keys and decrypt and execute the XLoader payload in memory. XLoader steals system and browser data and downloads additional malware, with communications to the reported C2 domain hxxp://www.dumbsplash[.]com/ilto/. This multifaceted attack requires unpatched Office components and victim interaction opening the DOCX attachment. Organizations should prioritize patching Equation Editor vulnerabilities and monitor related registry and scripting artifacts indicated by the attack chain. This attack echoes a similar 2025 campaign by ASEC involving XLoader and the same vulnerability but does not confirm shared threat actors.