PureRAT and PureLogs Campaign Targeting Japanese Organizations

Between July and August 2026, a phishing campaign targeted organizations primarily in Japan and other East and Southeast Asian countries. Attackers sent phishing emails in Japanese and Korean, impersonating product damage complaints to trick victims into visiting fake document-sharing sites. These sites delivered ZIP files containing malware executables with double extensions and DLLs using advanced loader techniques. The final malware payloads belonged to the PureRAT and PureLogs families. The campaign employed frequent changes in loader structures and multiple evasion methods to avoid detection. Infrastructure analysis revealed consistent patterns and identifiers across campaigns.

• Beware of Phishing Emails Disguised as Quote Confirmation Requests (PhantomStealer)Malware2026-08-19
• Beware of Phishing Email Disguised as Quotation Inquiry (SnakeKeylogger)Malware2026-11-12
• New Lindnor Backdoor and Glut of Security Killers Used in Ransomware Attack on U.S. OrgMalware2026-11-05
• Lunex Unmasked: A New Information Stealer Deployed Through BYOVDMalware2026-09-26
• RSVP to Disaster: How One Click Installs a RATMalware2026-10-13