Loading story…
Researchers reported an active phishing campaign targeting Windows users with invoice-themed emails that deliver the PawsRunner loader and ultimately deploy the PureLogs .NET infostealer. The attack begins with a TXZ archive containing JavaScript that hides malicious commands in environment variables, launches hidden PowerShell, decrypts an AES- and Gzip-protected payload, and loads a .NET assembly filelessly through reflection. Investigators said PawsRunner has evolved from directly downloading PE files to extracting encrypted payloads hidden inside PNG images, using steganography markers in iTXt and IEND chunks while rotating user-agents and Windows networking APIs to blend in.
The final payload, identified as PureLogs 5.0.0, profiles victims through WMI and steals data from browsers, wallet extensions, cryptocurrency wallets, communication apps, and other local applications before compressing and AES-encrypting exfiltrated data for HTTPS-based command-and-control. Reported indicators include the IP address 5.101.84.202, the URL hxxps://everycarebd[.]com/imagelkjh0987[.]png, and six associated SHA-256 hashes, with defenders also provided hunting queries for domains, URLs, IPs, and file hashes to support detection and incident response.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
Xavier Mertens reported a phishing-style infection chain using a legitimate WeTransfer link to a malicious JavaScript file that launched PowerShell via WMI and retrieved image-hosted payloads from Cloudflare Workers and Cloudflare R2. The analysis disclosed technical details including ROT13 and junk-code obfuscation, environment-variable staging, and a DLL disguised as a modified Microsoft.Win32.TaskScheduler library.
FortiGuard Labs analyzed a new PureLogs infostealer variant delivered through purchase-order-themed phishing emails, obfuscated JavaScript, and PowerShell that loads an encrypted .NET module in memory. The report highlighted process hollowing of the legitimate MsBuild.exe process and additional .NET Reactor and IntelliLock protection as new evasion features.
A Gurucul threat report described the same PureLogs-via-PawsRunner steganography campaign and provided detection queries for domains, URLs, IPs, and file hashes. This appears to be a follow-on publication of the already documented campaign rather than a new incident.
FortiGuard Labs reported a phishing campaign using invoice-themed emails, a JavaScript dropper, and the PawsRunner steganography loader to deploy the PureLogs 5.0.0 .NET infostealer on Windows systems. The report also disclosed technical details of the fileless loading chain, C2 behavior, and indicators of compromise.
Over time, the PawsRunner loader changed from directly downloading PE files to extracting encrypted payloads hidden in PNG images, and later added persistence and fallback logic. This reflected a notable escalation in the sophistication of the PureLogs delivery chain.
eSentire publicly detailed Amatera Stealer 4.0.2 Beta, describing its in-memory loader, anti-analysis features, expanded theft targets, and implementation flaws. The report included YARA rules and indicators of compromise to support detection and response.
In late April 2026, eSentire detected and blocked an attempted Amatera Stealer infection in a finance-sector customer environment using a ClickFix-to-PowerShell infection chain. The affected host was isolated and the customer was assisted with remediation.
Since November 2025, the Amatera Stealer malware added stronger string encryption, syscall-resolution techniques, anti-debugging and anti-analysis checks, geofencing, upgraded C2 encryption, and broader data-theft capabilities. These changes marked a significant evolution of the stealer compared with earlier variants.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
11 references tracked. Mallory keeps watching after this page renders.
isc.sans.edu
Open sourcesecurityonline.info
Open sourcecybersecuritynews.com
Open sourcecommunity.gurucul.com
Open sourcecommunity.gurucul.com
Open sourcefortinet.com
Open sourcefeeds.fortinet.com
Open sourceesentire.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported active phishing operations using business-document lures and fake "secure mail" messages to infect Windows users with **VIP Keylogger** and related infostealers. Splunk said attackers sent payment notices, procurement orders, and logistics updates carrying heavily obfuscated `.vbs`, `.js`, or `.bat` loaders that launched PowerShell stagers, hid data in environment variables, and used steganography in PNG files to rebuild the final payload. K7 Labs also tracked a malware-as-a-service **VIP_Keylogger** campaign, while Splunk said the malware injects into `aspnet_compiler.exe` and steals keystrokes, screenshots, browser and Outlook credentials, clipboard contents, and cryptocurrency wallet addresses before exfiltrating data to attacker infrastructure, including Telegram. AhnLab separately detailed a South Korea-focused campaign impersonating a major credit card company with malicious LNK files that executed PowerShell and `mshta`, fetched an HTA with obfuscated VBScript, and displayed decoy documents to reduce suspicion. The malware changed behavior depending on whether Windows Defender was enabled: one path delivered AES-encrypted archives with backdoor, keylogging, clipboard theft, and information-stealing components, while the other used `rundll32` to load a downloader that avoided VBox and VMware and then pulled additional payloads from Google Drive to steal browser, email, cookie, clipboard, and cryptocurrency wallet data. Defenders were urged to scrutinize email attachments and file types, monitor suspicious registry and PowerShell activity, and watch for script-launched processes and Telegram-related DNS traffic.
Jun 29, 2026
Phishing emails and malicious websites were used to trick users into launching **PowerShell**-driven malware chains that installed infostealers and stole credentials, clipboard data, and host information. In one case, an EDR alert on a finance user’s device showed `msedge.exe` spawning `powershell.exe`, followed by `curl.exe`, a downloaded DLL, and `rundll32.exe`; the decoded Base64 command used an `IEX` and `Net.WebClient.DownloadString` pattern to retrieve remote code after the user clicked an “Outstanding Invoice — Action Required” lure. The payload was identified as an **AgentTesla** variant, and responders isolated the host, revoked session tokens, reset credentials, and found two additional recipients of the same phishing email, though only one clicked and SmartScreen blocked the download. A related intrusion used a phishing site that instructed victims to open PowerShell as administrator and paste an encoded command copied to the clipboard, leading to the download of a ZIP archive and execution of `updater.exe`, a packed PyInstaller-based **DXI Infostealer** sample. The malware used a **UAC bypass** via the `ms-settings` registry hijack and `computerdefaults.exe`, added Microsoft Defender exclusions, disabled protections, collected system, network, antivirus, clipboard, screenshot, and browser-related data, and packaged the results with `rar.exe` before exfiltrating them through the **Telegram API** as command-and-control. The activity showed a consistent pattern of social engineering, PowerShell abuse, defense evasion, staged payload delivery, and HTTPS or Telegram-based data theft.
Jun 29, 2026
Researchers have identified a multi-stage malware campaign dubbed **VEIL#DROP** that uses social engineering, Google **Blogspot/Blogger** pages, and native Windows tooling to deliver the **PureLogs** information stealer. The infection chain starts with a JavaScript file disguised as a document, including filenames such as `transcript.pdf.js`, which executes through Windows Script Host and launches PowerShell with execution-policy bypasses. Additional stages are then retrieved from attacker-controlled Blogspot pages, decrypted with XOR routines, and loaded largely in memory to limit forensic evidence on disk. The malware chain uses dynamic URL generation, runtime mutation, reflective .NET loading, and fallback execution through Microsoft-signed living-off-the-land binaries including `regsvcs.exe`, `installutil.exe`, `msbuild.exe`, and `aspnet_compiler.exe` when direct in-memory execution is blocked. Researchers said the final **PureLogs** payload can steal browser credentials, cookies, autofill data, browsing history, cryptocurrency wallet information, and system details, creating a path for broader compromise that could extend to lateral movement and cloud intrusion while blending into legitimate administrative activity.
Jul 3, 2026