Japanese 'quote request' emails with .zip attachment deliver Formbook info-stealer

What happened

Japanese security researcher @bomccss posted on X on 10 November 2026 that Japanese-language emails with the subject "見積依頼 &お問い合わせ" (quote request and inquiry) were circulating that day. The attached ZIP, named like "見積依頼 &お問い合わせ 20261110170239.zip", contains a .wsf script that acts as a downloader; the researcher said it fetches a PowerShell script from a WordPress site's folder and installs Formbook, malware that steals information. The email body poses as an ordinary business request for a quote and drawings. Do not open script files (.wsf, .js, .vbs) from ZIP attachments, even when the email looks like routine business.

How the scam works

The emails are written as ordinary Japanese business correspondence: a request for a quotation and drawings, with a ZIP attachment whose name matches the subject line. According to the researcher, the ZIP contains a .wsf script that acts as a downloader, fetches a PowerShell script from a folder on a WordPress site and installs Formbook, which steals information such as passwords and saved data.

Opening the archive and the script is what starts the infection. A genuine quote request does not need a .wsf, .js or .vbs file. If you opened the attachment, disconnect the computer from the network, avoid entering more passwords on it, change important passwords from a different device, and have the computer examined. The report comes from the researcher's public post and has not been independently checked by scammers.com.

Source

Public post on X, 10 November 2026: https://x.com/bomccss/status/2120114940791103856

The indicators come from this source and have not been independently checked by scammers.com.