PureLogs delivered via steganographic PawsRunner loader in new

A phishing email with a fake invoice attachment delivers a TXZ archive that hides a JavaScript loader, which then launches a headless PowerShell process to decrypt and run the .NET PawsRunner loader entirely in memory [1]. PawsRunner contacts a remote server, fetches a PNG image that appears to be a cat picture, and extracts encrypted data embedded in the image’s iTXt and IEND chunks using steganography; the extracted payload is the PureLogs .NET infostealer [2].

The loader creates several environment variables, decodes an AES‑encrypted payload, and executes it via .NET reflection without writing files to disk, leaving only a hidden PowerShell window and a conhost.exe process as visible artifacts [1]. Once active, PureLogs immediately begins harvesting credentials from more than 80 browsers, password managers, and cryptocurrency wallet extensions such as MetaMask and Trust Wallet, then sends the data to a command‑and‑control server over HTTPS with additional AES‑256 encryption [1][2].

Researchers note that the campaign includes fallback URLs for the PNG download and rotates between three network APIs and user‑agent strings to evade detection, while also masquerading the malicious executable with cat icons to appear benign [2]. Mitigation guidance advises blocking TXZ attachments, monitoring for hidden conhost.exe and PowerShell –w flags, and deploying signatures for both PawsRunner and PureLogs, as well as applying steganography detection to inbound images [2].

The use of steganography to embed the final payload and the fileless, memory‑only execution chain raise the bar for traditional endpoint defenses, prompting security teams to consider deeper inspection of seemingly innocuous image files and tighter outbound traffic controls. The open question is how quickly defenders can adapt detection tooling to spot these layered, encrypted stages before the stolen credentials are exfiltrated.