+- Hack Forums (https://hackforums.net)
+-- Forum: Marketplace (https://hackforums.net/forumdisplay.php?fid=105)
+--- Forum: Auxiliary (https://hackforums.net/forumdisplay.php?fid=453)
+---- Forum: Member Sales Market (https://hackforums.net/forumdisplay.php?fid=176)
+---- Thread: XLLbased Excel addin dropper. (/showthread.php?tid=6330325)
XLLbased Excel addin dropper. - jason123 - Aug 15, 2026
“I’m excited to introduce XLL Dropper, a product developed after extensive research. It delivers effective performance and can bypass major antivirus solutions.”
🧑✈️ Compatibility list – This Excel plugin works thru Excel version 32-bit/64-bit support
1: Excel2013-Excel2016-Excel2019-Excel2021- Excel2024 (including 365) 🔆
Who need this XLL should start contract here in Hack Forums:
Terms of Sales Is stated below:
(a) 1 Build - $250
(b) 2 Builds - $400
© 5 Builds - $1,000
FAQ Q - Are you fast to replies?
Ans - Yes when I'm online or reach out at my TG chanel to get my direct dm contact Q - What makes you not to reply
Ans - When you try to de-market the product Q - How soon can you get the XLL file ready after payment confirmation?
Ans - within 24 hrs if am less busy but at most 48 hrs Q - Any refund
Ans - Refund is only applicable if paid product was not delivered otherwise no need for refunds after sales because the file is effective & durable (life time).
Click here to join TELEGRAM
The video below demonstrates its features clearly.
I just hope the harmless link video would be accepted here.
Video and Scan Result.
--------------------------------------------------------------------------------------------------------------------------
Disclaimer (Educational‑Use Only)
This software is provided solely for educational purposes. By using this software you:
Accept full responsibility for any misuse, illegal activity, or damage that may result from its operation.
Agree to comply with all applicable laws, regulations, and institutional policies governing the handling, analysis, or distribution of software, binaries, or data.
Acknowledge that the author assumes no liability for any direct, indirect, incidental, consequential, or punitive damages arising from the software’s use.
Understand that any third‑party services (e.g., cloud scanning APIs) invoked by the software have their own terms of service and privacy policies, which you must review and obey separately.
Use of this software implies acceptance of the above disclaimer.
[contract=tid]Start Contract[/contract]
RE: XLLbased Excel addin dropper. - ◔ßorder╙ineExtrⒶ - Aug 15, 2026
Hi, do we need FUD runtime crypted stub or does the load bypass/disable most AV security features? Macro needs to be enabled by default? Are there compatibility issues or vector execution inabilities (i.e. certain types of malware have a higher success rate % or viceversa)? Thanks, sounds promising.
RE: XLLbased Excel addin dropper. - jason123 - Aug 15, 2026
(Aug 15, 2026 08:50 AM)◔ßorder╙ineExtrⒶ Wrote: Hi, do we need FUD runtime crypted stub or does the load bypass/disable most AV security features? Macro needs to be enabled by default? Are there compatibility issues or vector execution inabilities (i.e. certain types of malware have a higher success rate % or viceversa)? Thanks, sounds promising.
Use of this software implies acceptance of the above disclaimer.
[/quote]
Hi, Thanks for the question.
Do we need FUD runtime crypted stub or does the load bypass/disable most AV security features?
Yeah you need your personal FUD runtime crypted stub. Besides, I tested with my stub (stealer) and if anyone needs it with the stub then it will be provided with the XLL.
Yeah Macro needs to be enabled just once as it's shown in the video.Though it has an auto feature that add_trusted_location which means in some PCs the user does not need to manually enable macros. Once the folder is trusted, Excel loads the XLL automatically, and the payload runs without any additional user interaction for the current user.I tested that on two different PCs and they work differently.
Are there compatibility issues or vector execution inabilities (i.e. certain types of malware have a higher success rate % or viceversa)?
The code reads the Version value under blablabla\Microsoft\Office and selects a registry key/path for the current user Office 2013‑2024 (15.0‑19.0).
Bottom line
It will run on any Office version that matches the coded version map (2013‑2024) and on the matching CPU architecture (x86 or x64) provided the user’s Trust Center settings allow adding a trusted location and no corporate policy blocks unsigned add‑ins, PS, or file‑system writes.
RE: XLLbased Excel addin dropper. - coocochi - Aug 26, 2026
Didnt know macro exploit are still a thing this recent, looks promising, GLWS
RE: XLLbased Excel addin dropper. - jason123 - Aug 27, 2026
(Aug 26, 2026 10:32 PM)coocochi Wrote: Didnt know macro exploit are still a thing this recent, looks promising, GLWS
Thanks Coocochi. Yes – macro‑style attacks are still active, and threat actors are increasingly using .xll Excel add‑ins to bypass macro restrictions.
RE: XLLbased Excel addin dropper. - stoned-geek - Sep 10, 2026
this payload have to be zipped can't be spreaded as single file (.xll) because of MARK of the web
RE: XLLbased Excel addin dropper. - jason123 - Sep 19, 2026
(Sep 10, 2026 02:24 AM)stoned-geek Wrote: this payload have to be zipped can't be spreaded as single file (.xll) because of MARK of the web
Said exact but it entails more to make it 100 % effective.
What is the point of just zipping the file and get detected on Runtime, and also cannot spread it across to all needed domains?
The XLL cannot be delivered by itself to the victim either via email attachment or web download due to organization policy
The XLL needs to be packaged inside a container, however due to DLP formats like ISO, IMG, and VHD are not viable.
The CURRENT-USER needs to be able to open the container natively without any third party software, which really leaves 'ARCHIVE' as the option.
Note this, I have made it possible to spread the XLL thru a method that makes it drop into any email domain including gmail, mail-DOT-com etc, without email spam detection.
Besides, I tried to add the video here but its not possible so to see the spreading method go over to the TG Channel above & watch the video.
For those that have sent me DM asking for possible method the ball is in your court now, see y'all.
RE: XLLbased Excel addin dropper. - stoned-geek - Sep 21, 2026
(Sep 19, 2026 10:11 AM)jason123 Wrote: Said exact but it entails more to make it 100 % effective.
What is the point of just zipping the file and get detected on Runtime, and also cannot spread it across to all needed domains?
The XLL cannot be delivered by itself to the victim either via email attachment or web download due to organization policy
The XLL needs to be packaged inside a container, however due to DLP formats like ISO, IMG, and VHD are not viable.
The CURRENT-USER needs to be able to open the container natively without any third party software, which really leaves 'ARCHIVE' as the option.
Note this, I have made it possible to spread the XLL thru a method that makes it drop into any email domain including gmail, mail-DOT-com etc, without email spam detection.
Besides, I tried to add the video here but its not possible so to see the spreading method go over to the TG Channel above & watch the video.
For those that have sent me DM asking for possible method the ball is in your court now, see y'all.
"What is the point of just zipping the file and get detected on Runtime, and also cannot spread it across to all needed domains?" You just replied that to your self here "The CURRENT-USER needs to be able to open the container natively without any third party software, which really leaves 'ARCHIVE' as the option." But the problem is archived files zip rar etc are not trusted any more so the the probability drops a lot Also you may be able to drop the .xll to any mailbox but still the motw will block the xll enable add in so the only method is to find a motw bypass only that way .xll will work otherwise this payload is useless.
RE: XLLbased Excel addin dropper. - jason123 - Sep 23, 2026
(Sep 21, 2026 01:46 AM)stoned-geek Wrote: "What is the point of just zipping the file and get detected on Runtime, and also cannot spread it across to all needed domains?" You just replied that to your self here "The CURRENT-USER needs to be able to open the container natively without any third party software, which really leaves 'ARCHIVE' as the option." But the problem is archived files zip rar etc are not trusted any more so the the probability drops a lot Also you may be able to drop the .xll to any mailbox but still the motw will block the xll enable add in so the only method is to find a motw bypass only that way .xll will work otherwise this payload is useless.
Hmm! You said - 'Also you may be able to drop the .xll to any mailbox but still the motw will block the xll enable add in'
My response is that not all archives are blocked by MOTW and not all archives versions are "untrusted" 🙂, You need a careful studies to get it right.some hidden methods are still in use till date so I have the method that drop the file in any mailbox and when opened the XLL enable add-in will work correctly without blocked.
The vid is there on the TG channel.The people using this method understand it well.
Try to study further to understand that logic.
RE: XLLbased Excel addin dropper. - stoned-geek - Sep 23, 2026
(Sep 23, 2026 01:07 AM)jason123 Wrote: Hmm! You said - 'Also you may be able to drop the .xll to any mailbox but still the motw will block the xll enable add in'
My response is that not all archives are blocked by MOTW and not all archives versions are "untrusted" 🙂, You need a careful studies to get it right.some hidden methods are still in use till date so I have the method that drop the file in any mailbox and when opened the XLL enable add-in will work correctly without blocked.
The vid is there on the TG channel.The people using this method understand it well.
Try to study further to understand that logic.
I did not say that archives are blocked by MOTW, but .xll is blocked from it so if you have the method that sends single file .xll to the mailbox with MOTW bypass then this tool is very good otherwise is useless since is uploaded for free here in this forum aswell.
RE: XLLbased Excel addin dropper. - jason123 - Sep 23, 2026
(Sep 23, 2026 08:04 AM)stoned-geek Wrote: I did not say that archives are blocked by MOTW, but .xll is blocked from it so if you have the method that sends single file .xll to the mailbox with MOTW bypass then this tool is very good otherwise is useless since is uploaded for free here in this forum aswell.
Then go and get it there and stop crowding my page with stylish throlling.
Go and study coding/h**king and bring your own knowledge for the community to see and not arguing on others effort
You wont get a reply on this topic again because you are just crowding this post, people like you are hard to pleased
BUMP - Stanley - Oct 6, 2026
I'm Stanley HF's helper bot. The OP (original poster) of this thread wants everyone to see this page and has elected to bump it to the top of the showthread listing. Since HF doesn't want a ton of LQP (Low Quality Posts) this is the best method of bumping your content. There is a small βyte fee for each bump. Any OP can bump any of their threads on HF from the linked icon on the top of their first post.
If you haven't already read the first post of this thread we encourage you to do so.
Thanks,
Stanley