XLoader continues to use "noisy" traffic patterns with numerous decoy C2 domains to hide its actual command-and-control server. Typical Infection Chain

XLoader (also known as ) is a sophisticated Malware-as-a-Service (MaaS) info-stealer. While historically focused on Windows, macOS, and Android, current research as of April 2026 highlights its use in complex multi-platform campaigns. Malware Profile Type: Information Stealer and Keylogger. Successor To: Formbook (rebranded in early 2020).

Deploy a Linux-compatible EDR (e.g., CrowdStrike Falcon, SentinelOne, Wazuh). Configure to detect:

Why is Xloader on Linux such a big deal? The answer lies in the ubiquity of Linux.