Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
StealerMalware Family
Active Threat
FormBook
High severity
66.9k
IOCs Tracked
2022
First Seen
Oct 21, 2026
Last Seen
0
YARA Rules
Associated IOCs66,859 total · showing 50
IP49
91.202.233.2142026-10-21High
101.200.193.2112026-10-21High
67.219.102.2442026-10-21High
15.204.95.2282026-10-21High
46.151.182.2052026-10-21High
162.248.225.1652026-10-21High
221.207.101.1752026-10-21High
109.73.193.2422026-10-01High
185.177.72.682026-09-24High
77.83.36.1632026-09-03High
5.101.86.982026-07-04High
5.101.86.1052026-07-06High
178.16.54.2482026-06-23High
88.119.167.1432026-08-17High
84.21.189.2252026-06-20High
107.175.148.682026-07-09High
39.107.242.1302026-10-20High
139.159.203.442026-10-21High
137.184.163.272026-10-21High
163.181.208.792026-10-21High
MD51
06394646a4d6d959de9420113ea28b362026-09-19High
Related Reports5 shown
Unpacking “Cruciferra”: An Analysis of a Sophisticated Crypter Service
Proofpoint Threat InsightJul 20, 2026
LxBase RAT first observed in attacks on Russian companies
BI.ZONEOct 2, 2026
Hackers Abuse EdgeUpdate and GoogleUpdater to Deploy TimbreStealer Infostealer
Cyber PressJul 4, 2026
Hackers Use Steganographic Loader to Deliver Remcos RAT via Phishing Attachments
Cyber PressJun 22, 2026
Malware Analysis — Formbook
0xMrMagneziApr 1, 2024
Threat Profile
TypeStealer
StatusActive
First SeenJul 29, 2022
Last SeenOct 21, 2026
IOCs tracked66,859