PureLogs Infostealer Spreads via Cat Photo Steganography

A phishing campaign is currently distributing the PureLogs information stealer by concealing encrypted malicious payloads within image files, a technique known as steganography [1]. Researchers at Fortinet discovered that the attackers are using cat photos to smuggle the malware onto Windows systems, allowing the malicious traffic to blend in with legitimate network activity [1].

Key takeaways

• The attack begins with a phishing email containing an invoice-themed lure and a TXZ archive [1].
• Malicious payloads are hidden inside PNG image files using steganography markers to evade security alarms [1].
• The PureLogs infostealer harvests credentials, cookies, and session tokens from web browsers, crypto wallets, and communication apps [1].
• The malware uses HTTPS for command and control communications and employs async/await patterns to complicate security analysis [1].

The Mechanics of the PawsRunner Delivery

The infection process initiates when a victim opens a TXZ archive attached to a phishing email [1]. Once extracted, a JavaScript file executes, using obfuscated process environment variables to launch a hidden PowerShell session [1]. This session is responsible for decoding and decompressing a .NET assembly loader identified as PawsRunner [1].

PawsRunner functions by decrypting a download URL using the RC4 algorithm and subsequently fetching a PNG image file [1]. By utilizing steganography, the attackers embed the final PureLogs payload within the image, a method that is increasingly popular because it avoids the scrutiny often applied to direct executable downloads [1]. Once the payload is extracted, the malware bypasses Windows 11 security features and Event Tracing for Windows to establish its presence on the host machine [1].

Data Exfiltration and System Impact

Once active, PureLogs profiles the compromised system to harvest sensitive information [1]. The infostealer targets a wide array of software, including over 100 crypto wallet extensions, various password managers, and communication platforms such as Telegram, Discord, and Signal [1]. It also extracts data from common desktop applications like Steam, FileZilla, and Outlook [1].

The stolen data is encrypted using AES before being exfiltrated to the attackers [1]. According to the researchers, this information can be used for direct financial theft or sold on criminal markets, potentially facilitating further attacks against the victim’s employer or personal contacts [1].

Why it matters

The use of steganography represents a deliberate shift in tactics designed to make malicious downloads appear as benign network traffic [1]. Because PNG files fetched over HTTPS are less likely to trigger security alerts than traditional executables, this method poses a significant challenge for standard endpoint protection [1]. Security experts advise organizations to block uncommon archive formats at email gateways, restrict JavaScript execution from attachments, and monitor for unusual PowerShell behavior to mitigate the risk of such campaigns [1].