Reverse engineering analysis of PureRAT RAT abusing msbuild.exe, extracting C2 infrastructure, .NET evasion APIs, file system manipulation, and VBScript persistence mechanisms.

Cybersecurity firm Sekoia reports a widespread fraud where criminals compromise hotel systems (Booking.com, Expedia and others) with PureRAT malware, then use stolen reservation data to phish and defraud guests.

Modified AllaKore RAT and Ghost Crypt crypter target Mexican entities and global victims for financial fraud.

PureRAT is a Remote Access Trojan, which can be used by an attacker to remotely control someone else's PC. PureRAT provides the following features to an attacker: See the victims user interfaceInt...

Researchers discover that PureRAT’s code now contains emojis – indicating it has been written by AI based-on comments ripped from social media.

SVG phishing emails drop CountLoader to deploy Amatera Stealer and PureMiner in Ukrainian government attack.

Researchers map a campaign that escalated from a Python infostealer to a full PureRAT backdoor — loaders, evasions, and TLS-pinned C2. Join Huntress Labs' Tradecraft Tuesday for deep technical walkthroughs and live IOC guidance on the latest cybersecurity topics.

Please stop classifying malware as zgRAT. That malware label is confusing. As far as I know, there isnt a proper definition of what zgRAT actually is. Some claim that zgRAT is the same malware family ...

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

Introduction A new phishing campaign linked to a Vietnamese threat actor is showing how artificial intelligence is reshaping cybercrime at street level. By abusing AI tools to generate polished scripts, detailed malware loaders, and convincing social engineering lures, the attacker has managed to distribute PureRAT malware through fake job offers. What makes this operation notable is not just the malware itself, but how AI has lowered the technical barrier, allowing relatively unsophisticated actors to deploy complex attack chains with professional-looking code and documentation.

Russian organizations have become the target of a phishing campaign that distributes malware called PureRAT, according to new findings from Kaspersky. "The campaign aimed at Russian business began back in March 2023, but in the first third of 2025 the number of attacks quadrupled compared to the same period in 2024," the cybersecurity vendor said. The attack chains, which have not been

Sekoia.io exposes a Booking.com phishing campaign targeting hotels and customers using ClickFix and PureRAT malware.

An Alarming Example of Malware Innovation and Social Engineering A new and highly coordinated cyberattack has been uncovered by eSentire’s Threat Response Unit (TRU), targeting a U.S.-based certified public accounting (CPA) firm. What makes this attack so dangerous is the sophisticated mix of social engineering, stealthy malware techniques, and abuse of legitimate cloud services like Zoho WorkDrive. At the heart of the campaign was a powerful remote access trojan known as PureRAT, hidden behind layers of deception and delivered through a malware obfuscation service called Ghost Crypt.