Loading story…
A multi-stage PureLogs/PureLog Stealer campaign is targeting organizations through fake Adobe Sign messages, copyright-violation lures, and Google Ads malvertising, with observed victim focus on healthcare and government entities in Germany and Canada and additional activity in the United States and Australia. The attack chain uses decoy documents and localized executables to trick users, then pulls encrypted payloads from attacker-controlled infrastructure including quickdocshare[.]com, chickplaybox[.]com, PixelDrain staging links, logs[.]bestshopingday[.]com, and 103.107.199.61, with related outbound traffic also tied to 166[.]0[.]184[.]127.
The malware execution flow is heavily evasive and largely fileless, combining browser fingerprinting, RC4 decryption, steganography in PNG iTXt metadata, process environment variable abuse, PowerShell, AMSI bypass, and reflective loading of encrypted .NET components to run the stealer entirely in memory. Researchers said the campaign also abuses renamed legitimate tools, including WinRAR and a Python interpreter masquerading as svchost.exe, while establishing persistence through the HKCU\Environment\UserinitMprLogonScript registry key, capturing screenshots, and using redundant loaders and process injection to reduce forensic artifacts and improve resilience.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
A separate PureLog Stealer campaign targeted healthcare and government organizations primarily in Germany and Canada, with additional activity in the United States and Australia. It used localized copyright-violation themed executables and Google Ads malvertising to deliver a multi-stage infection chain.
Researchers described a multi-stage malware campaign delivering PureLogs Stealer through a fake Adobe Sign-themed phishing lure. The attack used browser fingerprinting, RC4 decryption, PowerShell, process environment variables, PNG iTXt steganography, and in-memory execution, with persistence via HKCU\Environment\UserinitMprLogonScript.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 25 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
trendaisecurity.com
Open sourcecommunity.gurucul.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported an active phishing campaign targeting Windows users with invoice-themed emails that deliver the **PawsRunner** loader and ultimately deploy the **PureLogs** `.NET` infostealer. The attack begins with a `TXZ` archive containing JavaScript that hides malicious commands in environment variables, launches hidden PowerShell, decrypts an AES- and Gzip-protected payload, and loads a .NET assembly filelessly through reflection. Investigators said PawsRunner has evolved from directly downloading PE files to extracting encrypted payloads hidden inside PNG images, using steganography markers in `iTXt` and `IEND` chunks while rotating user-agents and Windows networking APIs to blend in. The final payload, identified as **PureLogs 5.0.0**, profiles victims through WMI and steals data from browsers, wallet extensions, cryptocurrency wallets, communication apps, and other local applications before compressing and AES-encrypting exfiltrated data for HTTPS-based command-and-control. Reported indicators include the IP address `5.101.84.202`, the URL `hxxps://everycarebd[.]com/imagelkjh0987[.]png`, and six associated `SHA-256` hashes, with defenders also provided hunting queries for domains, URLs, IPs, and file hashes to support detection and incident response.
Jun 29, 2026
Researchers have identified a multi-stage malware campaign dubbed **VEIL#DROP** that uses social engineering, Google **Blogspot/Blogger** pages, and native Windows tooling to deliver the **PureLogs** information stealer. The infection chain starts with a JavaScript file disguised as a document, including filenames such as `transcript.pdf.js`, which executes through Windows Script Host and launches PowerShell with execution-policy bypasses. Additional stages are then retrieved from attacker-controlled Blogspot pages, decrypted with XOR routines, and loaded largely in memory to limit forensic evidence on disk. The malware chain uses dynamic URL generation, runtime mutation, reflective .NET loading, and fallback execution through Microsoft-signed living-off-the-land binaries including `regsvcs.exe`, `installutil.exe`, `msbuild.exe`, and `aspnet_compiler.exe` when direct in-memory execution is blocked. Researchers said the final **PureLogs** payload can steal browser credentials, cookies, autofill data, browsing history, cryptocurrency wallet information, and system details, creating a path for broader compromise that could extend to lateral movement and cloud intrusion while blending into legitimate administrative activity.
Jul 12, 2026
Multiple campaigns are using phishing emails and archive-based lures to deliver remote access malware through stealthy, multi-stage infection chains. Point Wild documented **Remcos RAT**, **DesckVB RAT**, and a Rust-based **COVERT RAT** being delivered through ZIP attachments, weaponized `LNK` files, obfuscated JavaScript droppers, and hidden PowerShell execution, often with decoy documents to mask activity. The payloads were loaded filelessly through .NET reflection and in-memory execution, with operators abusing legitimate binaries and services such as `aspnet_compiler.exe`, GitHub, and paste or web-hosting platforms to stage malware while evading detection. Reported command-and-control infrastructure included `192.3.27.141:8087`, `172.245.246.77:8080`, and `181.231.253.69:4444`, while observed artifacts included `C:\ProgramData\remcos\logs.dat`, `C:\ProgramData\colors\logs.dat`, and payload names such as `ALTERNATE.dll`, `ClassLibrary3.dll`, `Keylogger.dll`, and `msedge_proxy.exe`. Separate reporting showed the same tradecraft extending beyond custom RATs to commodity remote-access software and credential theft. A campaign targeting Russian aerospace and aviation organizations used invoice-themed phishing and spoofed domains to install a portable **AnyDesk** instance for unattended access, maintain persistence with a scheduled task, minimize visibility with Tray Minimizer, and exfiltrate configuration data through a command-line SMTP mailer; Seqrite linked the activity to **Rare Werewolf (Librarian Ghouls)**. Securonix research cited by Trojan Killer described **VEIL#DROP** using fake document-style JavaScript files, Blogspot-hosted staging, PowerShell download cradles, XOR decoding, and in-memory .NET loading to deploy **PureLog Stealer**, which targets browser credentials, cookies, session tokens, wallet data, and host information. Across the campaigns, the common pattern is phishing-led initial access followed by LOLBins, PowerShell, staged downloads, persistence, and covert data theft or long-term remote control.
Jul 12, 2026