PawsRunner Steganography Loader Delivers Evolved .NET PureLogs Infostealer
PawsRunner Steganography Loader Delivers Evolved .NET (TL-2026-0521), also tracked as PawsRunner loader campaign, is a high-severity malware campaign, first published 2026-05-17. It has no confirmed attribution, affects Microsoft Windows, maps to 30 MITRE ATT&CK techniques (T1005, T1027, T1027.003), and is covered by 9 detection rules and 19 indicators of compromise.
Key facts for TL-2026-0521
- Threat ID
- TL-2026-0521
- Also known as
- PawsRunner loader campaign, PureLogs 2026 stego campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-05-17
- Last reviewed
- 2026-05-17
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- financial, e-commerce, small-business, retail, professional-services, technology
- Target regions
- Global, North America, Europe, Asia-Pacific, South Asia
- Detection rules
- 9
- Indicators of compromise
- 19
Malware and tooling in PawsRunner Steganography Loader Delivers Evolved .NET
Malware and tooling: PawsRunner, PureLogs, Pure malware family (Pure Coder MaaS)
FortiGuard Labs detailed a May 2026 phishing campaign that distributes an evolved variant of the .NET PureLogs infostealer through a novel staged loader dubbed PawsRunner. The chain weaponizes TXZ archive attachments, a JavaScript dropper that conceals payloads in Windows environment variables, headless conhost/PowerShell execution, AES decryption with Gzip decompression, and fileless .NET reflective assembly loading to deploy PureLogs against Windows endpoints for browser credential, crypto wallet, and messaging token theft.
How PawsRunner Steganography Loader Delivers Evolved .NET works
On May 15, 2026, Fortinet FortiGuard Labs researchers Winnie Lin and Yurren Wan disclosed an active phishing campaign delivering an evolved generation of the PureLogs information stealer via a previously undocumented multi-stage loader the researchers named PawsRunner. PureLogs is a commodity .NET-based infostealer family that has been sold on Russian-language cybercrime forums since 2022 as part of the broader 'Pure' malware-as-a-service ecosystem (PureCrypter, PureMiner, PureHVNC, PureLogs). The May 2026 campaign represents a notable tradecraft evolution: rather than executing the stealer directly from disk, the operators chain steganography, environment-variable based payload storage, and reflective code loading to keep the final .NET payload fileless throughout the post-compromise lifecycle.
The intrusion begins with phishing emails carrying a TXZ archive (an unusual lzma-compressed tarball format chosen specifically because it bypasses many email gateway filters that focus on ZIP, RAR, and ISO containers). Inside the archive is an obfuscated JavaScript dropper that, when launched via the Windows Script Host (wscript.exe), executes the first stage of PawsRunner. The dropper first writes a sizable AES-encrypted blob into a uniquely named Windows user environment variable (the variable name is randomized per infection but follows a recognizable pattern of pseudo-random alphanumerics). It then spawns a hidden conhost.exe child process using the rarely abused '--headless' flag, which suppresses console window creation while still permitting standard input/output redirection — a defense-evasion technique that defeats GUI-based hidden-window heuristics. Through the headless conhost host, the dropper launches PowerShell with an inline command that retrieves the encrypted payload back out of the environment variable, AES-decrypts it using a hardcoded key, GZip-decompresses the plaintext, and finally invokes [System.Reflection.Assembly]::Load() to load the resulting .NET assembly directly into the PowerShell process memory. The reflectively loaded assembly is PawsRunner itself, which acts as an in-memory orchestrator: it pulls a second-stage payload — disguised as a PNG image at hxxps://everycarebd[.]com/imagelkjh0987[.]png — strips the image header bytes, decrypts the appended payload using a second AES key, and reflectively loads the final PureLogs stealer assembly without ever touching disk.
The evolved PureLogs variant retains the core capabilities of prior generations — Chromium and Gecko browser credential, cookie, and autofill harvesting; cryptocurrency wallet theft (Exodus, Atomic, Electrum, Jaxx, and 30+ browser extension wallets); Discord, Telegram, Steam, and Pidgin token theft; FileZilla and WinSCP credential extraction; system fingerprinting; and Outlook profile theft — but adds several anti-analysis improvements: ETW patching against amsi.dll and clr.dll before stealer modules execute, expanded virtualization checks (looking for VirtualBox, VMware, Sandboxie, ANY.RUN, and CAPE artifacts in registry, MAC ranges, and running processes), and a delayed-execution sleep gated by GetSystemTimeAsFileTime that defeats accelerated-clock sandboxes. Stolen data is bundled into a ZIP container, encrypted, and exfiltrated over a raw TCP channel to C2 IP 5.101.84.202 on a non-standard high port. Fortinet observed the campaign targeting Windows users globally, with telemetry concentrations in financial services, e-commerce, and small/medium business sectors.
Defensive priorities: block TXZ attachments at the email gateway; alert on wscript.exe spawning conhost.exe with the --headless flag (a strong behavioral signal with very low legitimate use); alert on PowerShell command lines that read large data from Get-Item Env: variables and pipe into [System.Reflection.Assembly]::Load; monitor for outbound connections to 5.101.84.202 and DNS lookups for everycarebd[.]com; deploy AMSI/ETW tamper detections; and hunt for any of the six known PawsRunner/PureLogs SHA256 hashes across endpoint EDR file inventory.
MITRE ATT&CK techniques used in TL-2026-0521
Collection
T1005 Data from Local System; T1115 Clipboard Data; T1560.002 Archive Collected Data: Archive via Library
Defense Evasion
T1027 Obfuscated Files or Information; T1027.003 Obfuscated Files or Information: Steganography; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information; T1497.001 Virtualization/Sandbox Evasion: System Checks; T1497.003 Time Based Checks; T1564.003 Hide Artifacts: Hidden Window; T1620 Reflective Code Loading
Exfiltration
T1041 Exfiltration Over C2 Channel
Discovery
T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1518.001 Security Software Discovery
Execution
T1059.001 Command and Scripting Interpreter: PowerShell; T1059.007 Command and Scripting Interpreter: JavaScript; T1106 Native API; T1204.002 User Execution: Malicious File
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1095 Non-Application Layer Protocol; T1105 Ingress Tool Transfer; T1573.001 Encrypted Channel: Symmetric Cryptography
Credential Access
T1539 Steal Web Session Cookie; T1552.001 Unsecured Credentials: Credentials In Files; T1555 Credentials from Password Stores; T1555.003 Credentials from Password Stores: Credentials from Web Browsers
Initial Access
T1566.001 Phishing: Spearphishing Attachment
defense-impairment
Affected products and versions in PawsRunner Steganography Loader Delivers Evolved .NET
- Microsoft — Windows
Vulnerable versions: Windows 10; Windows 11; Windows Server 2016; Windows Server 2019; Windows Server 2022 - Multiple — Chromium-based browsers (Chrome, Edge, Brave, Opera, Vivaldi)
Vulnerable versions: all currently shipping - Mozilla — Firefox / Gecko-based browsers
Vulnerable versions: all currently shipping
Remediation for PawsRunner Steganography Loader Delivers Evolved .NET
Immediate actions
- Block inbound emails carrying .txz archive attachments at the email security gateway
- Sinkhole or block DNS resolution for everycarebd[.]com at recursive resolvers and DNS firewall
- Block outbound network traffic to C2 IP 5.101.84.202 across all egress points
- Hunt EDR file inventory for the six known PawsRunner/PureLogs SHA256 hashes and isolate any hits
- Alert on wscript.exe or cscript.exe spawning conhost.exe with the --headless command-line flag
- Alert on PowerShell command lines containing [System.Reflection.Assembly]::Load combined with [System.Convert]::FromBase64String or AES decryption primitives
Workarounds
- Remove .txz from allowed mail attachment types entirely if not business-justified
- Disable Windows Script Host via registry: HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings\Enabled = 0
- Configure PowerShell Constrained Language Mode for non-administrative users to block reflective Assembly.Load
Longer-term hardening
- Deploy or tune EDR with .NET reflective-load detection (CLR ETW provider visibility into Assembly.Load events)
- Enable AMSI for PowerShell 5+ and monitor for AMSI bypass / ETW patching attempts against amsi.dll and clr.dll
- Restrict execution of Windows Script Host (wscript.exe, cscript.exe) via AppLocker or WDAC for all non-administrative users
- Deploy Attack Surface Reduction (ASR) rule 'Block JavaScript or VBScript from launching downloaded executable content' (GUID d3e037e1-3eb8-44c8-a917-57927947596d)
- Implement strict outbound egress filtering with allow-lists for business-required destinations only
- Conduct user security awareness training emphasizing archive-format phishing lures and rare extensions (.txz, .ace, .7z, .img)
Timeline of PawsRunner Steganography Loader Delivers Evolved .NET
- PureLogs infostealer first advertised on Russian-language cybercrime forums by the 'Pure Coder' operator as part of the broader Pure malware-as-a-service ecosystem (PureCrypter, PureMiner, PureHVNC).
- Zscaler ThreatLabz publishes a detailed analysis of PureCrypter, establishing the Pure family lineage and shared loader/packer infrastructure that later underpins PawsRunner.
- Earliest FortiGuard Labs telemetry observation of the PawsRunner-delivered PureLogs variant in customer environments, predating public disclosure by approximately one month.
- Phishing volume of TXZ-archive lures carrying PawsRunner JS droppers accelerates, with FortiGuard observing waves targeting financial services and e-commerce verticals across North America and Europe.
- C2 infrastructure consolidated around 5.101.84.202 with staging payload hosted at hxxps://everycarebd[.]com/imagelkjh0987[.]png; six distinct loader/stealer SHA256 hashes catalogued across the campaign.
- Fortinet FortiGuard Labs researchers Winnie Lin and Yurren Wan publish 'PureLogs: Delivery via PawsRunner Steganography', the first public technical disclosure of the loader and the evolved stealer variant.
- Threadlinqs Intelligence platform publishes consolidated threat record TL-2026-0521 with full MITRE ATT&CK mapping, IOC catalog, and detection coverage for SOC and threat-hunting consumers.
- As of 2026-05-29, this remains an ACTIVE in-the-wild PureLogs/PawsRunner infostealer campaign disclosed by FortiGuard (May 15) and corroborated by Help Net Security, GBHackers and others, with no takedown, sinkhole, or arrest. PureLogs is a thriving Pure Coder MaaS (no CVE to patch); the C2/IOCs will rotate but the actor and fileless stego TTPs stay live.
Sources cited for PawsRunner Steganography Loader Delivers Evolved .NET
- PureLogs: Delivery via PawsRunner Steganography
- MITRE ATT&CK T1027.003 — Steganography
- MITRE ATT&CK T1620 — Reflective Code Loading
- MITRE ATT&CK T1566.001 — Spearphishing Attachment
- MITRE ATT&CK T1059.007 — JavaScript
- MITRE ATT&CK T1059.001 — PowerShell
- Microsoft ASR rule — Block JavaScript or VBScript from launching downloaded executable content
- PureCrypter / Pure malware family overview (historical context)
Threats related to PawsRunner Steganography Loader Delivers Evolved .NET
- Fake Game Downloads Deliver Amatera Stealer via Ren'Py Loader, MSBuild Abuse, and EtherHiding C2
- ACR Stealer (Amatera Stealer) Uses ClickFix Lures, WebDAV/pushd DLL Delivery, and EtherHiding to Harvest Browser and Microsoft 365 Data
- CloudZ RAT with Pheno Plugin Hijacks Microsoft Phone Link to Steal SMS and OTPs (Cisco Talos, 2026-05)
- Kynx Stealer: MaaS Infostealer Targeting Crypto Wallets, Gaming Platforms, and AI Coding Tools
- EtherRAT: Node.js Remote Access Trojan with Ethereum Blockchain C2 Resolution and Per-Execution Self-Reobfuscation
- Remus Stealer: 64-bit Lumma-Derived Infostealer-as-a-Service with EtherHiding Blockchain C2 and Application-Bound Encryption Bypass
Detection coverage for TL-2026-0521
As of 2026-05-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0521 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.