XLoader, a Malware-as-a-Service info stealer and keylogger, has evolved from its predecessor FormBook, to target both Windows and macOS systems. For macOS, it disguises itself as a legitimate app like OfficeNote or distributes through phishing emails with .jar files requiring Java Runtime Environment. Upon execution, it drops a file and continues to execute malicious components even without user interaction. It attempts to steal credentials from browsers, notably Chrome and Firefox, and employs various evasion techniques, including anti-debugging measures to thwart analysis.