Loading story…
A purchase-quotation malspam campaign impersonated an employee of a legitimate company and delivered a recovery-volume-style .r01 RAR attachment containing obfuscated JavaScript tracked as LausivLoader. The script created persistence, stored encrypted payload fragments in a randomly named temporary directory, and passed their locations to a hidden PowerShell process through inherited environment variables. PowerShell reassembled, decoded, AES-decrypted, decompressed, and reflectively loaded a 64-bit .NET component entirely in memory; later stages attempted to impair AMSI protections and retrieved a PNG from yapw[.]life.
The .NET loader was designed to recover a final PE payload from an iTXt metadata chunk within the PNG and execute it in memory or through process hollowing. The final payload was not recovered in the analyzed sample, but the execution chain matches reporting on HypeAgent, a multi-stage infostealer targeting browser credentials, email accounts, cryptocurrency wallets, and authenticated sessions for Claude, ChatGPT, and Cursor, with WebSocket-based command-and-control support. Organizations should block the identified hosting domain, scrutinize quotation-themed archive attachments, and hunt for suspicious hidden PowerShell processes, scheduled-task persistence, and .NET reflective loading activity.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
HypeAgent was documented as a high-severity multi-stage infostealer using JavaScript, PowerShell, .NET loaders, scheduled-task persistence, PNG steganography, reflective loading, AMSI bypass techniques, and process hollowing. It targets browser credentials, email and cryptocurrency accounts, and authenticated Claude, ChatGPT, and Cursor sessions; reported indicators included files.catbox.moe/knujwn.png and 209.54.103.173.
Analysis found that the JavaScript establishes scheduled-task persistence, stages encrypted fragments in a temporary directory, and passes their paths to a hidden PowerShell process through inherited environment variables. The chain decrypts and reflectively loads .NET stages, attempts AMSI interference, and was configured to download a PNG-hosted payload from yapw[.]life, though the final payload was unavailable.
A customer-operated mail gateway quarantined a late-August email impersonating a legitimate-company employee and requesting a quotation for a fiber-optic system. The message failed SPF and DMARC checks and carried an .r01 archive containing an obfuscated JavaScript LausivLoader sample.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
isc.sans.edu
Open sourcemalware.news
Open sourcecommunity.gurucul.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported multiple malware delivery chains that **hide or embed executable payloads inside image files** to evade detection. Veracode analyzed a malicious typosquatted NPM package, `buildrunner-dev`, that uses a `postinstall` hook to run `init.js`, which downloads an obfuscated batch script (`packageloader.bat`) from a Codeberg repository. The batch script ultimately retrieves PNG images hosted on a free image service and extracts hidden data from RGB pixel values (steganography), leading to a loader with **process hollowing**, **encrypted payload handling**, **AMSI bypass**, and per-AV evasion logic, culminating in deployment of the **Pulsar .NET RAT**. Separately, SANS ISC documented a phishing/malspam-style infection chain starting from an Excel attachment exploiting **CVE-2017-11882** (Equation Editor), which downloads an HTA that launches PowerShell to fetch a PNG (`optimized_MSI.png`) containing a Base64-encoded .NET payload delimited by `BaseStart-` and `-BaseEnd` tags. The handler noted **reuse of the same image across campaigns**, used VirusTotal similarity searches to identify many related samples, and produced a YARA rule to track the technique. Kaspersky’s write-up on **Arkanix Stealer** describes a MaaS stealer ecosystem (C++ and Python variants, ChromElevator usage, and broad credential/crypto theft) but does not center on image-based payload hiding, making it a separate topic from the image-steganography delivery chains described by Veracode and SANS ISC.
Jun 29, 2026
A multi-stage **PureLogs/PureLog Stealer** campaign is targeting organizations through fake Adobe Sign messages, copyright-violation lures, and Google Ads malvertising, with observed victim focus on healthcare and government entities in Germany and Canada and additional activity in the United States and Australia. The attack chain uses decoy documents and localized executables to trick users, then pulls encrypted payloads from attacker-controlled infrastructure including `quickdocshare[.]com`, `chickplaybox[.]com`, PixelDrain staging links, `logs[.]bestshopingday[.]com`, and `103.107.199.61`, with related outbound traffic also tied to `166[.]0[.]184[.]127`. The malware execution flow is heavily evasive and largely fileless, combining browser fingerprinting, RC4 decryption, steganography in PNG `iTXt` metadata, process environment variable abuse, PowerShell, AMSI bypass, and reflective loading of encrypted .NET components to run the stealer entirely in memory. Researchers said the campaign also abuses renamed legitimate tools, including WinRAR and a Python interpreter masquerading as `svchost.exe`, while establishing persistence through the `HKCU\Environment\UserinitMprLogonScript` registry key, capturing screenshots, and using redundant loaders and process injection to reduce forensic artifacts and improve resilience.
Aug 21, 2026
Researchers documented a **multi-stage PowerShell malware delivery chain** that served script content directly from `203[.]188[.]171[.]166` and `dorenzaa[.]com`, then pulled additional payloads from Vercel-hosted infrastructure. The observed chain downloaded archives and executables including `Grape2.zip`, `UltraToolliteSetup.exe`, and `draw.zip`, extracted them into user directories such as `%LOCALAPPDATA%\jsDownload` and `%APPDATA%`, and launched files including `Grape.exe`. Investigators said the infrastructure behaved like a staged loader rather than a normal website, with multiple remote components used to fetch and run follow-on payloads. The PowerShell loaders used **hidden execution**, dynamically constructed `IEX`, Base64 decoding, and repeating-key XOR obfuscation with the key `"write"`, while displaying a decoy prompt reading **"Verification complete!"** under the window title **"Google.com"**. Analysts published indicators including the IP address, domain, file names, hashes, and execution paths, but said the **initial infection vector** and the **ultimate functionality of several downloaded executables** remained undetermined, and no threat actor attribution was made.
Aug 8, 2026