From infostealer to full RAT: dissecting the PureRAT attack chain

This report analyzes a malware campaign initially identified as a Python-based infostealer that ultimately leads to the deployment of PureRAT, a commercially available remote access trojan (RAT). The campaign involves multiple stages and tools, including various loaders and stealers, culminating in full RAT capabilities. Indicators such as IP addresses and file hashes are provided for detection and blocking. No specific affected software versions or CVEs are identified. The threat is assessed as medium severity due to its capability to escalate from information theft to full remote access.

• LiteLLM supply chain compromiseCampaign2026-10-22
• PureRAT and PureLogs Campaign Targeting Japanese OrganizationsCampaign2026-09-25
• Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooksHighVulnerability2026-10-23
• CVE-2026-115419: multiagent-a2a · Unintended disclosure of data element to wrong session in Strands Agents SDK A2A ServerHighVulnerability2026-10-22
• Aoki: Infostealer Targets AI Coding Assistant CredentialsMalware2026-10-15