Hackers Hide PureLogs Infostealer in PawsRunner Loader

Threat actors are increasingly hiding malware inside seemingly harmless files, and a new campaign shows just how effective this tactic has become.

The attack begins with a phishing email carrying a TXZ archive attachment. Disguised as an urgent invoice, the file pressures victims into opening it quickly.

Once extracted, the archive reveals a JavaScript file filled with misleading comments written in multiple languages, likely to evade analysis.

Behind the noise, the script defines numerous environment variables containing obfuscated malicious commands.

It then launches PowerShell in hidden mode via conhost.exe, ensuring the attack runs silently. The script decrypts its payload using AES, decompresses it with Gzip, and executes it directly in memory using reflection leaving minimal forensic traces.

The decoded payload is a . NET-based loader identified as PawsRunner. This loader decrypts another executable and prepares it for execution. Notably, it often uses cat images as its application icon, a small but consistent trait across samples.

FortiGuard Labs said in a report shared with GBhackers, uncovered a phishing operation that uses steganography and environment-variable abuse to deploy the PureLogs infostealer via a custom loader dubbed PawsRunner.

PawsRunner initializes configuration data, including encrypted URLs and network settings. It decrypts command-and-control (C2) URLs using RC4 and cycles through multiple APIs like HttpClient and WebRequest to download additional payloads.

A key innovation lies in how it requests data. The loader prioritizes PNG images in HTTP responses.

If a PNG is returned, it extracts hidden data embedded within the image using steganography. Specifically, it looks for markers within PNG chunks such as “iTXt” and “IEND” to locate encrypted payload data.

For example, a harmless-looking cat image may secretly contain encrypted malware appended within its structure. Once extracted and decrypted, this hidden data reveals the next-stage payload.

The JavaScript file extracted from the archive contains several functions, each preceded by irrelevant comments. These comments are in a mix of languages, including Chinese, Japanese, Korean, Russian, Hindi, and Arabic.

If the primary download fails, PawsRunner includes a fallback mechanism using alternative URLs, though some samples leave these blank.

Hackers Hide PureLogs Infostealer

Researchers note that earlier versions of this loader downloaded executable files. Over time, it evolved to extract payloads from images, making detection significantly harder.

Since March 2026, multiple iterations have introduced persistence mechanisms and improved evasion techniques, including bypasses for Windows 11 security features.

The consistent use of cat-themed imagery and similar code patterns led analysts to classify this loader family as PawsRunner.

The final payload delivered is PureLogs, a .NET-based infostealer linked to the Pure malware family. It uses .NET Reactor for obfuscation and Protobuf for configuration handling.

PureLogs begins by loading a resource-only assembly, which it decrypts using TripleDES and decompresses into a functional DLL. This component retrieves configuration data such as C2 server details, encryption keys, and campaign identifiers.

Before executing its main functions, the malware checks connectivity with its C2 server via a /ping endpoint. It then downloads additional modules from /plugin endpoints, decrypts them using AES-256, and executes them in memory.

PureLogs is designed for extensive data harvesting. It collects:

• Browser data from dozens of Chromium- and Firefox-based browsers.
• Credentials, cookies, and autofill data.
• Cryptocurrency wallet information and extensions.
• Password manager and authenticator data.
• Files, VPN configurations, and messaging app data.

It uses Windows Management Instrumentation (WMI) to profile the infected system and sends collected data to the C2 server via encrypted HTTP POST requests.

Each data type is exfiltrated through dedicated endpoints such as /browser, /crypto, and /filesearch.

Unlike older versions, this variant uses asynchronous operations to improve speed and evade detection. All transmitted data is encrypted with AES and compressed using Gzip.

This campaign highlights a growing shift toward “legitimate-file-plus-hidden-data” techniques. By embedding malware inside images, attackers bypass traditional security tools that rely on file inspection.

As this technique becomes more common, organizations must enhance detection strategies to inspect file structures and monitor unusual network behavior because even a simple cat picture can now conceal a full-scale cyberattack.

IOCs

C2:

5[.]101[.]84[.]202.

URLs:

hxxps://everycarebd[.]com/imagelkjh0987[.]png.

SHA256:

8d0bcde739929fe41a6bcaaa62f7cba802af90b2ba8dea6ed1a4821236cdd588.
6910d27b9e1dc2229a8c280f5d0cea85146d50274c56a4d9a5b8d1793505b1b9.
93724f1a9ad3a28c171927fc449ac34dc6ca890f915f00210e8b305577388c6e.
0fcb86ae384e9975933314ac2a231f0ff46c0208556bf4a16f096a642d3f505e.
1b730de72f921458b6b162b105a9521a931f07e19d3cac53207c7a8efbc412f9.
e2308749f6b7b7573009d0cac6616a6aa83cecb1f2933e868776400d122c86ec.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.