PawsRunner Steganography Loader Delivers Evolved .NET PureLogs Infostealer — Threadlinqs Intelligence
As of 2026-05-30, PawsRunner Steganography Loader Delivers Evolved .NET PureLogs Infostealer is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 19 indicators of compromise.
Threat ID: TL-2026-0521 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
FortiGuard Labs detailed a May 2026 phishing campaign that distributes an evolved variant of the .NET PureLogs infostealer through a novel staged loader dubbed PawsRunner. The chain weaponizes TXZ
On May 15, 2026, Fortinet FortiGuard Labs researchers Winnie Lin and Yurren Wan disclosed an active phishing campaign delivering an evolved generation of the PureLogs information stealer via a previously undocumented multi-stage loader the researchers named PawsRunner. PureLogs is a commodity .NET-based infostealer family that has been sold on Russian-language cybercrime forums since 2022 as part of the broader 'Pure' malware-as-a-service ecosystem (PureCrypter, PureMiner, PureHVNC, PureLogs). The May 2026 campaign represents a notable tradecraft evolution: rather than executing the stealer directly from disk, the operators chain steganography, environment-variable based payload storage, and reflective code loading to keep the final .NET payload fileless throughout the post-compromise lifecycle.
The intrusion begins with phishing emails carrying a TXZ archive (an unusual lzma-compressed tarball format chosen specifically because it bypasses many email gateway filters that focus on ZIP, RAR, and ISO containers). Inside the archive is an obfuscated JavaScript dropper that, when launched via the Windows Script Host (wscript.exe), executes the first stage of PawsRunner. The dropper first writes a sizable AES-encrypted blob into a uniquely named Windows user environment variable (the variable name is randomized per infection but follows a recognizable pattern of pseudo-random alphanumerics). It then spawns a hidden conhost.exe child process using the rarely abused '--headless' flag, which suppresses console window creation while still permitting standard input/output redirection — a defense-evasion technique that defeats GUI-based hidden-window heuristics. Through the headless conhost host, the dropper launches PowerShell with an inline command that retrieves the encrypted payload back out of the environment variable, AES-decrypts it using a hardcoded key, GZip-decompresses the plaintext, and finally invokes [System.Reflection.Assembly]::Load() to load the resulting .NET assembly directly into the PowerShell process memory. The reflectively loaded assembly is PawsRunner itself, which acts as an in-memory orchestrator: it pulls a second-stage payload — disguised as a PNG image at hxxps://everycarebd[.]com/imagelkjh0987[.]png — strips the image header bytes, decrypts the appended payload using a second AES key, and reflectively loads the final PureLogs stealer assembly without ever touching disk.
The evolved PureLogs variant retains the core capabilities of prior generations — Chromium and Gecko browser credential, cookie, and autofill harvesting; cryptocurrency wallet theft (Exodus, Atomic, Electrum, Jaxx, and 30+ browser extension wallets); Discord, Telegram, Steam, and Pidgin token theft; FileZilla and WinSCP credential extraction; system fingerprinting; and Outlook profile theft — but adds several anti-analysis improvements: ETW patching against amsi.dll and clr.dll before stealer modules execute, expanded virtualization checks (looking for VirtualBox, VMware, Sandboxie, ANY.RUN, and CAPE artifacts in registry, MAC ranges, and running processes), and a delayed-execution sleep gated by GetSystemTimeAsFileTime that defeats accelerated-clock sandboxes. Stolen data is bundled into a ZIP container, encrypted, and exfiltrated over a raw TCP channel to C2 IP 5.101.84.202 on a non-standard high port. Fortinet observed the campaign targeting Windows users globally, with telemetry concentrations in financial services, e-commerce, and small/medium business sectors.
Defensive priorities: block TXZ attachments at the email gateway; alert on wscript.exe spawning conhost.exe with the --headless flag (a strong behavioral signal with very low legitimate use); alert on PowerShell command lines that read large data from Get-Item Env: variables and pipe into [System.Reflection.Assembly]::Load; monitor for outbound connections to 5.101.84.202 and DNS lookups for everycarebd[.]com; deploy AMSI/ETW tamper detections; and hunt for any of the six know
Target sectors: financial, e-commerce, small-business, retail, professional-services, technology
Target regions: Global, North America, Europe, Asia-Pacific, South Asia
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 19 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1566.001, T1204.002, T1059.007, T1059.001, T1106, T1027.003, T1027, T1140, T1620, T1564.003