I analyzed some PureLogs malware infections this morning and found some interesting behavior and artifacts that I want to share. PureLogs infections sometimes start with a dropper/downloader that retr...

CapLoader includes a feature for Port Independent Protocol Identification (PIPI), which can detect which protocol is being used inside of TCP and UDP sessions without relying on the port number. In th...

Swiss Post Cybersecurity traced a suspicious JavaScript file to a stealthy PURELOGS stealer that hides its payload within a PNG file.

Hackers are using fake purchase order emails and process hollowing to deploy fileless PureLogs malware to steal Windows users' browser, crypto, and Discord data.

The AISI Research Center's Cybersecurity Observatory publishes the report "Dissecting a new malspam chain delivering Purelogs infostealer"

FortiGuard Labs identified a phishing campaign that delivers a PureLogs variant through a fake purchase-order email carrying a malicious RAR archive and JavaScript file. The attack chain uses PowerShell, process hollowing, and a downloader to load an in-memory plugin that steals browser, Discord, crypto wallet, and application data from Windows systems. #PureLogs #FortiGuardLabs #MsBuild.exe #Discord #MicrosoftEdge #FileZilla

Hackers are using fake purchase order emails and process hollowing to deploy fileless PureLogs malware to steal Windows users' browser, crypto, and Discord data.

FortiGuard Labs analyzed a new phishing campaign that uses obfuscated JavaScript, PowerShell, process hollowing, and PureLogs to steal sensitive data…

Empowering everyone to build reliable and efficient software.

Please stop classifying malware as zgRAT. That malware label is confusing. As far as I know, there isnt a proper definition of what zgRAT actually is. Some claim that zgRAT is the same malware family ...

A comprehensive security operations platform empowered by AI to enable uninterrupted protection against potential threats.

Russian organizations have become the target of a phishing campaign that distributes malware called PureRAT, according to new findings from Kaspersky. "The campaign aimed at Russian business began back in March 2023, but in the first third of 2025 the number of attacks quadrupled compared to the same period in 2024," the cybersecurity vendor said. The attack chains, which have not been

ITrust (https://www.itrust.fr), publiée le 2 septembre 2026. L'analyse fait suite à une alerte EDR déclenchée mi-juillet 2026 chez un client, bloquant une communication réseau issue d'une exécution PowerShell. Le CERT ITrust a rétro-ingénié la chaîne complète malgré le blocage de l'attaque.

Parmi les attaques quotidiennes qui sont observées par les analystes SOC durant leur supervision, les malwares de type stealer ont une place de choix.

Please stop classifying malware as zgRAT. That malware label is confusing. As far as I know, there isnt a proper definition of what zgRAT actually is. Some claim that zgRAT is the same malware family as PureLogs, while others argue that zgRAT should be mapped to PureRAT. There is also a blog post by[...]