Hackers use fake purchase order emails and malicious Word documents to spread XLoader malware and steal browser data.