Phishing Campaign Deploys JavaScript-Driven PureLogs Variant to Steal Sensitive Data

A sophisticated phishing campaign distributes a PureLogs variant through deceptive purchase order emails containing malicious JavaScript files. The attack chain employs obfuscated JavaScript that drops PowerShell scripts, which then use process hollowing techniques to inject .NET modules into legitimate Windows processes. The malware communicates with command-and-control infrastructure to download additional plugins. PureLogs collects extensive sensitive information including credentials from web browsers, cryptocurrency wallets, email clients, Discord, and various applications. It also captures screenshots, system information, and clipboard data. The collected data is compressed, encrypted with AES, and exfiltrated to remote servers. The campaign demonstrates advanced evasion techniques through fileless execution, multiple encryption layers, and abuse of trusted processes like MsBuild.exe, making detection challenging for traditional security solutions.

• Managed for Malice: How Attackers Turn MDM into Remote AccessCampaign2026-10-28
• How VBScript Malware Evades Detection Using Trusted Tools CopyMalware2026-10-27
• Tricks from the Past deployed via signed ChatGPT and Claude binariesMalware2026-10-27
• Microsoft Teams to get AI-powered, context-aware phishing detectionNews2026-10-23
• Technology that blocks DGA domains | Kaspersky official blogAnalysis2026-10-23