PureLogs Stealer
PureLogs Stealer is an information-stealing malware family used to harvest saved information from browsers, cryptocurrency wallets, messaging applications, and other applications. The provided reporting explicitly describes it as a credential harvester and information stealer. It has been observed as part of broader cybercrime operations alongside PureRAT, PureHVNC, ResolverRAT, and likely Lumma/ZgRAT, including campaigns analyzed by Breakglass Intelligence that were active since at least November 2025. In that activity, delivery involved ClearFake/ClickFix fake browser update lures and a Donut in-memory loader executing an obfuscated .NET payload. The associated malware ecosystem used encrypted HTTPS communications, RSA and AES-based protected channels, certificate pinning, and multiple fallback ports. Huntress also reported a February 2026 fake OpenClaw installer campaign in which a Rust-based loader, svc_service.exe, was suspected of running PureLogs Stealer in memory; that campaign used malicious GitHub repositories surfaced via Bing AI search results and broadly targeted users searching for OpenClaw installers on Windows and macOS. Additional phishing activity observed by Cofense used lures themed around the U.S. Social Security Administration and copyright infringement to distribute information stealers including PureLogs Stealer. PureLogs Stealer was also named among malware developed by PureCoder and was reported in attacks recorded between August and November 2025 alongside Pay2Key ransomware and other PureCoder tooling such as PureCrypter and PureHVNC. High-confidence infrastructure and technical details in the supplied content primarily describe the broader campaign ecosystem rather than PureLogs-specific internals; however, reported related indicators include domains such as dndhub[.]xyz and kampf[.]huehnchenfarm[.]ru, IP address 45[.]141[.]119[.]34, and the suspected loader artifact svc_service.exe.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
12 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 technique
Resource Development
Initial Access
1 technique
Initial Access
Execution
3 techniques
Execution
Stealth Packer is a new packer that... creates hidden ghost scheduled tasks... EdgeUpdateHelper Scheduled Task ... Set to run ... AdobeCloudHelper.exe daily
Persistence
1 technique
Persistence
Privilege Escalation
1 technique
Privilege Escalation
Stealth
2 techniques
Stealth
Credential Access
2 techniques
Credential Access
Command and Control
2 techniques
Command and Control
IOCs tracked for this family
46 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Credential-stealing malware that harvests data from browsers, wallets, and applications. It is deployed alongside RAT and HVNC components in the same campaign.
PureLogs Stealer is an information stealer. Here it was suspected to be executed in memory by a Rust-based loader packed with Stealth Packer and connected back to attacker infrastructure.
Information stealer malware used to exfiltrate credentials and sensitive data from infected systems.
Information stealer malware that exfiltrates credentials and other sensitive information from victims.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.