# PawsRunner Steganography Loader Delivers Evolved .NET PureLogs Infostealer

> FortiGuard Labs detailed a May 2026 phishing campaign that distributes an evolved variant of the .NET PureLogs infostealer through a novel staged loader dubbed PawsRunner. The chain weaponizes TXZ archive attachments, a JavaScript dropper that conceals payloads in Windows environment variables, headless conhost/PowerShell execution, AES decryption with Gzip decompression, and fileless .NET reflective assembly loading to deploy PureLogs against Windows endpoints for browser credential, crypto wallet, and messaging token theft.

- **Published:** 2026-05-17T12:00:00Z
- **Last reviewed:** 2026-05-17T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0521
- **ID:** TL-2026-0521
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On May 15, 2026, Fortinet FortiGuard Labs researchers Winnie Lin and Yurren Wan disclosed an active phishing campaign delivering an evolved generation of the PureLogs information stealer via a previously undocumented multi-stage loader the researchers named PawsRunner. PureLogs is a commodity .NET-based infostealer family that has been sold on Russian-language cybercrime forums since 2022 as part of the broader 'Pure' malware-as-a-service ecosystem (PureCrypter, PureMiner, PureHVNC, PureLogs). The May 2026 campaign represents a notable tradecraft evolution: rather than executing the stealer directly from disk, the operators chain steganography, environment-variable based payload storage, and reflective code loading to keep the final .NET payload fileless throughout the post-compromise lifecycle.

The intrusion begins with phishing emails carrying a TXZ archive (an unusual lzma-compressed tarball format chosen specifically because it bypasses many email gateway filters that focus on ZIP, RAR, and ISO containers). Inside the archive is an obfuscated JavaScript dropper that, when launched via the Windows Script Host (wscript.exe), executes the first stage of PawsRunner. The dropper first writes a sizable AES-encrypted blob into a uniquely named Windows user environment variable (the variable name is randomized per infection but follows a recognizable pattern of pseudo-random alphanumerics). It then spawns a hidden conhost.exe child process using the rarely abused '--headless' flag, which suppresses console window creation while still permitting standard input/output redirection — a defense-evasion technique that defeats GUI-based hidden-window heuristics. Through the headless conhost host, the dropper launches PowerShell with an inline command that retrieves the encrypted payload back out of the environment variable, AES-decrypts it using a hardcoded key, GZip-decompresses the plaintext, and finally invokes [System.Reflection.Assembly]::Load() to load the resulting .NET assembly directly into the PowerShell process memory. The reflectively loaded assembly is PawsRunner itself, which acts as an in-memory orchestrator: it pulls a second-stage payload — disguised as a PNG image at hxxps://everycarebd[.]com/imagelkjh0987[.]png — strips the image header bytes, decrypts the appended payload using a second AES key, and reflectively loads the final PureLogs stealer assembly without ever touching disk.

The evolved PureLogs variant retains the core capabilities of prior generations — Chromium and Gecko browser credential, cookie, and autofill harvesting; cryptocurrency wallet theft (Exodus, Atomic, Electrum, Jaxx, and 30+ browser extension wallets); Discord, Telegram, Steam, and Pidgin token theft; FileZilla and WinSCP credential extraction; system fingerprinting; and Outlook profile theft — but adds several anti-analysis improvements: ETW patching against amsi.dll and clr.dll before stealer modules execute, expanded virtualization checks (looking for VirtualBox, VMware, Sandboxie, ANY.RUN, and CAPE artifacts in registry, MAC ranges, and running processes), and a delayed-execution sleep gated by GetSystemTimeAsFileTime that defeats accelerated-clock sandboxes. Stolen data is bundled into a ZIP container, encrypted, and exfiltrated over a raw TCP channel to C2 IP 5.101.84.202 on a non-standard high port. Fortinet observed the campaign targeting Windows users globally, with telemetry concentrations in financial services, e-commerce, and small/medium business sectors.

Defensive priorities: block TXZ attachments at the email gateway; alert on wscript.exe spawning conhost.exe with the --headless flag (a strong behavioral signal with very low legitimate use); alert on PowerShell command lines that read large data from Get-Item Env: variables and pipe into [System.Reflection.Assembly]::Load; monitor for outbound connections to 5.101.84.202 and DNS lookups for everycarebd[.]com; deploy AMSI/ETW tamper detections; and hunt for any of the six known PawsRunner/PureLogs SHA256 hashes across endpoint EDR file inventory.

## MITRE ATT&CK

- T1566.001 Phishing: Spearphishing Attachment
- T1204.002 User Execution: Malicious File
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1106 Native API
- T1027.003 Obfuscated Files or Information: Steganography
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1620 Reflective Code Loading
- T1564.003 Hide Artifacts: Hidden Window
- T1685 Disable or Modify Tools
- T1497.001 Virtualization/Sandbox Evasion: System Checks
- T1497.003 Time Based Checks
- T1036.005 Match Legitimate Resource Name or Location
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1555 Credentials from Password Stores
- T1539 Steal Web Session Cookie
- T1552.001 Unsecured Credentials: Credentials In Files
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1518.001 Security Software Discovery
- T1057 Process Discovery
- T1005 Data from Local System
- T1115 Clipboard Data
- T1560.002 Archive Collected Data: Archive via Library
- T1071.001 Application Layer Protocol: Web Protocols
- T1095 Non-Application Layer Protocol
- T1573.001 Encrypted Channel: Symmetric Cryptography
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel

## Sources

- [PureLogs: Delivery via PawsRunner Steganography](https://www.fortinet.com/blog/threat-research/purelogs-delivery-via-pawsrunner-steganography)
- [MITRE ATT&CK T1027.003 — Steganography](https://attack.mitre.org/techniques/T1027/003/)
- [MITRE ATT&CK T1620 — Reflective Code Loading](https://attack.mitre.org/techniques/T1620/)
- [MITRE ATT&CK T1566.001 — Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
- [MITRE ATT&CK T1059.007 — JavaScript](https://attack.mitre.org/techniques/T1059/007/)
- [MITRE ATT&CK T1059.001 — PowerShell](https://attack.mitre.org/techniques/T1059/001/)
- [Microsoft ASR rule — Block JavaScript or VBScript from launching downloaded executable content](https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-reference)
- [PureCrypter / Pure malware family overview (historical context)](https://www.zscaler.com/blogs/security-research/purecrypter-fully-functional-loader-distributing-remote-access-trojans)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0521