reinigung-kosanke.de: a hacked WordPress site that served Formbook PowerShell scripts, and what to do

What reinigung-kosanke.de is, and what we know about it

reinigung-kosanke.de is a web address, not a program on your PC. The abuse.ch project URLhaus lists four files on it as malware downloads, all tagged Formbook. The folder they sit in belongs to WordPress itself, which points to a normal business site that someone broke into. No public write-up of this one domain exists that we could find, so this page rests on what URLhaus shows, what we saw ourselves and what Microsoft, Forcepoint and WordPress.org have published.

1. 1

   What URLhaus lists

   Four file addresses on reinigung-kosanke.de, all added on 29 September 2026 by the reporter abuse_ch between 06:33 and 12:42 UTC. Each is a PowerShell script whose name ends in CRYPTED_STUB.ps1, and each carries the tags ascii, Formbook, powershell and ps1. All four have the threat type malware_download and were offline when we read them.

2. 2

   Why the folder matters

   The files sit under /wp-includes/theme-compat/ followed by three folders with random names. wp-includes is a core WordPress folder that normally holds only files shipped by WordPress. A script with a random path inside it was put there by someone who had write access to the server. That is our reading, not a statement from the site owner.

3. 3

   What the tags mean

   ps1 is the ending of a PowerShell script. Formbook is the name of a malware family that Microsoft detects as Trojan:Win32/Formbook and TrojanSpy:Win32/FormBook. The tag is the reporter's label. We did not download the scripts, so it is not our finding.

4. 4

   What we could not confirm

   We do not know how visitors were sent to these files, who received them, what the scripts do step by step, or how the site was broken into. We also do not know whether the owner has cleaned it since.

Kind of threat

A malware download address on a hacked WordPress site; four PowerShell scripts tagged Formbook

Where the files sit

/wp-includes/theme-compat/ in random subfolders, file names ending in CRYPTED_STUB.ps1

Domain registration

Not available: our lookup has no RDAP server for the .de ending, so we give no registration date

URLhaus entries

4 file addresses, all added on 29 September 2026; all offline when we read them

Platform

Windows, by the ps1 tag and by Microsoft's detection names. No source says other systems are hit

What we checked on 9 October 2026, and what we could not

We opened https://reinigung-kosanke.de/ once, from Lithuania, in an automated Chromium browser set to English. The server answered with a 503 error page. That is a broken or switched-off site, not a clean one.

What happened to reinigung-kosanke.de, in dates

The history we can document is one day long. The dates come from the URLhaus database and from our own test.

1. 29 September 2026, 06:33 and 06:34 UTC

   Two scripts are reported

   URLhaus adds two addresses ending in MCRYPTED_STUB.ps1 and OJCRYPTED_STUB.ps1, both in the same wp-includes/theme-compat subfolder, with the tags ascii, Formbook, powershell and ps1. This is the first time URLhaus sees the host.

2. 29 September 2026, 07:41 UTC

   A third script is added

   A file ending in 22CRYPTED_STUB.ps1 is listed with the same tags and the same folder.

3. 29 September 2026, 12:42 UTC

   A fourth script is added

   The file ending in myCRYPTED_STUB.ps1 is the last entry. All four are marked offline by the time we read them, which means the files were no longer served at the time of the checks.

   

4. 9 October 2026

   Our test gets a 503 page

   Our browser visit to https://reinigung-kosanke.de/ ends on a Service Temporarily Unavailable page. We do not know whether the site is switched off for cleaning or broken.

We could not read the URLhaus pages themselves, because they ask for a browser check. The entries above come from the same data in our own database, which holds the URLhaus feed.

What Formbook is, and what a campaign with it can look like

Microsoft lists two detection names for Formbook and rates both as severe. Forcepoint has described one campaign in detail. That campaign is not this site, and the steps below show what is possible, not what happened here.

The point for you is that a PowerShell stage can leave very little on disk. A normal scan of files may find nothing even when the memory-only part ran, which is why the plan below ends with an offline scan and, after a real run, a reinstall.

The four files: what each name suggests, and what we do not know

File names are weak evidence. We list what URLhaus shows and mark which statements are only a reading of the name.

The tag ascii and the word CRYPTED in the name say the script text is probably obfuscated, but that is a reading of the label, not something we checked. We fetched none of the files, so we name no behaviour beyond what the tags say.

What this can cost you

Reading the site name or seeing a warning costs nothing. The risks below apply to a Windows PC where one of these scripts, or a command that fetched it, was run.

• High

  Stolen logins

  Microsoft files Formbook under TrojanSpy, its label for programs that spy on the user. Treat every password typed or saved on that PC as seen by someone else.

• High

  A hidden program that starts again

  In the campaign Forcepoint describes, a scheduled task ran a script every minute. Until such a task is gone, the PC keeps starting the chain.

• Medium

  Work accounts and company data

  On a work PC the saved passwords reach company systems. Tell your IT team at once so they can block the accounts.

• Medium

  Damage to the hacked site's own customers

  If you ever sent your details to the cleaning company through its site, someone with control of the server may have seen them. We have no evidence of this; it is a possibility to weigh.

• Low

  Nothing, if you only saw the name

  A name in a warning, a firewall log or a blocked link is not an infection.

What you may notice, and what you may not

Most victims of a spying program notice nothing. The signs below follow from the chain Forcepoint describes and from how PowerShell leaves traces.

How people could end up running one of these scripts

We do not know how visitors reached these files, and no source says. The routes below are common ways a script on a hacked website reaches a PC; they are a list of possibilities.

1. 1

   A link in a phishing email

   The email links straight to a file on a real, trusted business site, which passes a quick look at the address. The file is a script or a document that fetches one.

2. 2

   A document that fetches the script

   A Word or other document runs a macro or a hidden command that downloads the .ps1 and starts it. This is the pattern in the Forcepoint campaign, which began with a Word document.

3. 3

   A pasted command

   A page asks you to paste a line into the Windows Run box or PowerShell. The line downloads the script from the hacked site. Never paste a command from a web page.

4. 4

   A message from someone you know

   A hacked account sends the link to its contacts, which is why you may trust it.

Check your Windows PC before you delete anything

Start with one question: did you run a .ps1 file, or paste a command, that came from reinigung-kosanke.de? If yes, follow the plan on this page, because a clean-looking check does not clear a PC. If you are not sure, do these checks first. None of them deletes anything.

While you check, stop using the PC for banking, email or work, and disconnect it from Wi-Fi and the network cable if you can.

1. 1

   Check Windows Security

   Open Windows Security > Virus & threat protection > Protection history. On Windows 10 the same page is under Settings > Update & Security > Windows Security. Look for a Formbook name or any detection dated around the time you ran the file.

2. 2

   Look for a scheduled task you did not make

   Press the Windows key, type Task Scheduler and open it. Select Task Scheduler Library and read the names and the Actions tab of any task that is new or has a random name. Note the name; do not delete anything yet.

3. 3

   Look in the Startup folder

   Press Windows key + R, type shell:startup and press Enter. A .vbs, .cmd or .ps1 file you did not put there is suspect. Note it.

4. 4

   Read the Run box history

   If you pasted a command, open Registry Editor and go to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU. Each value is a line typed into Run. Read it, do not run it, and write down any line that names this site or contains powershell.

5. 5

   Remember what a clean check means

   A payload loaded into memory can leave nothing in these places, as the Forcepoint chain shows. A clean check lowers the doubt; it does not remove it.

Scan from outside Windows: Microsoft Defender Offline

An offline scan runs before the normal Windows starts, so a hidden program cannot hide from it as easily. Microsoft's page says it targets malware that tries to bypass the Windows shell, such as rootkits.

1. 1

   Prepare

   Save your work and close programs. Microsoft says the scan takes about 15 minutes and restarts the PC. It needs an administrator account and Windows Recovery Environment turned on. To check, open a Command Prompt as administrator and run reagentc /info; if it says Disabled, run reagentc /enable.

2. 2

   Suspend BitLocker if it is on

   If BitLocker protects the system drive, suspend it first. Otherwise the PC may ask for your recovery key when it restarts into the scan.

3. 3

   Start the scan

   Open Windows Security > Virus & threat protection > Scan options. Choose Microsoft Defender Offline scan and select Scan now. Agree to the prompts. The PC signs you out, restarts into the scan and starts Windows again when it ends.

4. 4

   Read the result

   Open Windows Security > Virus & threat protection > Protection history. Microsoft says the scan only works on x64 Windows 10 and 11, not on ARM, and that it needs Microsoft Defender Antivirus as the main antivirus.

5. 5

   Do not stop there

   A scan that finds nothing does not prove the PC is clean if the script ran and loaded its payload into memory. If you ran one of these scripts, the safest end of the plan is to back up documents and reinstall Windows.

If you own or manage reinigung-kosanke.de or another hacked WordPress site

Files that visitors cannot normally upload, sitting in wp-includes, mean someone had write access to the server. The WordPress.org guide to hacked sites gives the order below. A clean-up that skips the way in will be undone.

1. 1

   Take a copy and write down what you see

   WordPress.org advises a snapshot of the site as it is, even infected, before the clean-up, and a note of what you saw and when. Here the notes start with the four .ps1 files in wp-includes/theme-compat.

2. 2

   Tell your host and lock access

   Ask the host whether other sites on the account are hit and what they log. Change every access point: SFTP, WP-Admin, the host's control panel and the database user, and do it for all users. Replace the secret keys in wp-config.php so every logged-in session ends.

3. 3

   Scan your own computer first

   WordPress.org says attackers often start from trojans on the site owner's own machine that sniff FTP and WP-Admin logins. Run a full scan on the PC you use for the site, with a second scanner if you can.

4. 4

   Replace wp-admin and wp-includes

   Download the same WordPress version you run and copy the /wp-admin and /wp-includes folders over by SFTP. Do not use the reinstall button in WP-Admin: it only overwrites existing files, and hacks add new ones. Delete the whole theme-compat folder first and look for any file in it that is not in the official release.

5. 5

   Go through wp-content, .htaccess and users

   Check plugins, themes and uploads for files you do not recognise, especially PHP files in uploads. WordPress.org names .htaccess as the file most often changed, and index.php, header.php, footer.php and functions.php as high-value targets. Open Users in the dashboard and remove any administrator you did not add.

6. 6

   Update, change passwords again, ask the community

   When the site is clean, update WordPress, themes and plugins, and change the passwords again, including the database user. The WordPress.org Hacked and Malware forums can help if you are stuck.

7. 7

   Find the way in

   Look at which plugin or login was the entry point, and remove anything unused. Register the site with Google Search Console and Bing Webmaster Tools, as WordPress.org suggests, so you see blocklist warnings early.

If you use a Mac, an iPhone or an Android phone

The ps1 tag and Microsoft's Win32 detection names point at Windows. We found nothing that says the four files run on anything else.