This threat involves a sophisticated phishing campaign that delivers a PureLogs malware variant through malicious JavaScript embedded in purchase order emails. The JavaScript is obfuscated and drops PowerShell scripts that perform process hollowing to inject .NET modules into legitimate Windows processes, such as MsBuild.exe. The malware communicates with command-and-control servers to download additional plugins. PureLogs harvests a wide range of sensitive information, including credentials from web browsers, cryptocurrency wallets, email clients, Discord, and other applications, along with screenshots, system data, and clipboard contents. Collected data is compressed and encrypted using AES before exfiltration. The campaign leverages fileless execution and multiple encryption layers to evade detection by conventional security solutions.

The malware compromises confidentiality by stealing extensive sensitive information including user credentials, cryptocurrency wallet data, email and messaging client data, screenshots, system details, and clipboard contents. This data theft can lead to identity theft, financial loss, unauthorized access to accounts, and further compromise of affected systems. The use of advanced evasion techniques reduces the likelihood of detection and mitigation by traditional endpoint security tools, increasing the risk of prolonged undetected presence.

No official patch or vendor advisory is provided for this malware variant. Mitigation should focus on user awareness to recognize and avoid phishing emails, especially those containing unexpected purchase orders or JavaScript attachments. Endpoint detection and response solutions should be updated to detect behaviors such as process hollowing, PowerShell script execution from email attachments, and abuse of trusted processes like MsBuild.exe. Network monitoring for known command-and-control IP addresses and URLs (e.g., 77.83.39.211 on port 8443) can help identify and block exfiltration attempts. Since this is a malware campaign rather than a software vulnerability, remediation involves detection and removal rather than patching. Patch status is not yet confirmed — check vendor advisories for updates.