JavaScript-Driven PureLogs Infostealer Variant Delivered via Purchase-Order Phishing with Process Hollowing into MsBuild.exe
JavaScript-Driven PureLogs Infostealer Variant Delivered via (TL-2026-0591), also tracked as JS-PureLogs, is a high-severity malware campaign, first published 2026-05-26. It has no confirmed attribution, affects Microsoft Windows (all supported versions), maps to 32 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 30 indicators of compromise.
Key facts for TL-2026-0591
- Threat ID
- TL-2026-0591
- Also known as
- JS-PureLogs, PureLogs JS Variant, PO Phishing PureLogs Campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-05-26
- Last reviewed
- 2026-05-26
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- finance, procurement, manufacturing, logistics, small-and-medium-business
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 30
Malware and tooling in JavaScript-Driven PureLogs Infostealer Variant Delivered via
Malware and tooling: MAFF.ProcessHollowing, PureLogs, MsBuild.exe (LOLBAS)
FortiGuard Labs has documented an active phishing campaign delivering an obfuscated JavaScript loader (kpankocrs.js) inside purchase-order-themed RAR attachments. The loader drops a PowerShell script, which decrypts an in-memory .NET module that performs process hollowing into the signed Microsoft binary MsBuild.exe to deploy a downloader and ultimately load a fileless PureLogs infostealer plugin from C2 77.83.39.211:8443.
How JavaScript-Driven PureLogs Infostealer Variant Delivered via works
## Overview
FortiGuard Labs disclosed (26 May 2026) a phishing operation distributing a new JavaScript-driven variant of the PureLogs commodity infostealer. The campaign relies on social-engineering bait that mimics business-to-business purchase-order correspondence, attaching a RAR archive (PO 2026-P0803.rar) containing a heavily obfuscated JavaScript file (kpankocrs.js). Upon execution by wscript.exe, the loader writes a random-named PowerShell script (ps_*.ps1) to C:\Temp and launches it with bypass parameters. The PowerShell stage Base64-decodes and XOR-with-rotation-decrypts an embedded .NET assembly (MAFF.ProcessHollowing), which it loads reflectively via Invoke-AssemblyMethod. MAFF.ProcessHollowing creates a suspended instance of the Microsoft .NET Framework's MsBuild.exe (C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe), unmaps its original image, allocates RWX memory, writes a runtime payload (Iwnflr.exe SHA-256 B90988400C...), restores the thread context, and resumes execution — classic Stuxnet-style process hollowing into a signed LOLBin.
## Stage 2 - Downloader (Iwnflr.exe)
The hollowed MsBuild.exe now hosts Iwnflr.exe, a .NET downloader that decrypts a DES-encrypted internal configuration block to recover its C2 endpoint (77.83.39.211:8443) and an AES key. The downloader issues an HTTPS GET to /ping for health-check, then POSTs an AES-encrypted host fingerprint to /plugin. The C2 returns the next-stage plugin payload — Rmiyj.dll (SHA-256 E20B35A8...) — which loads reflectively in the same hollowed MsBuild.exe process. No second-stage binary is written to disk; the chain remains fileless from the PowerShell stage forward.
## Stage 3 - PureLogs Infostealer Plugin (zgSGkYYzqVe.dll)
The final plugin (zgSGkYYzqVe.dll SHA-256 07CD03E2...) is a fileless variant of the PureLogs infostealer. It harvests browser-stored credentials, cookies, autofill data, and history from Chromium and Gecko-based browsers; cryptocurrency wallet files for desktop wallets (Exodus, Atomic, Electrum, etc.); Discord tokens; FTP/email/VPN client credentials; and arbitrary user files matching attacker-supplied search terms. Collected data is AES-encrypted and exfiltrated via POSTs to C2 URI paths /userinfo, /browser, /discord, /crypto, /application, and /filesearch/req. The session is terminated by a GET to /finish.
## Why This Matters
The chain is notable for: (1) entirely fileless execution after the PowerShell loader, including in-memory .NET module loading and reflective DLL execution, (2) abuse of MsBuild.exe — a digitally signed Microsoft binary commonly allowlisted in EDR baselines — as a process-hollowing target, (3) DES + AES dual-layer crypto for configuration and traffic, evading naïve string-based detection, and (4) commodity-stealer-as-modular-plugin architecture where the loader and infostealer are independently swappable. The attack chain provides high-fidelity detection opportunities at multiple stages: wscript.exe -> powershell.exe parent-child relationships, MsBuild.exe spawned without a project file argument, MsBuild.exe with anomalous outbound network connections, and the specific URI-path beacon pattern.
## Recommended Posture
Block 77.83.39.211/32 at perimeter. Hunt for MsBuild.exe processes lacking project arguments, especially those with outbound TLS to non-Microsoft IPs. Disable .js script execution by Windows Script Host where business need does not require it. Mail-gateway block .rar attachments from external senders for finance/procurement mailboxes.
MITRE ATT&CK techniques used in TL-2026-0591
Collection
T1005 Data from Local System; T1560 Archive Collected Data; T1560.003 Archive via Custom Method
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1055 Process Injection; T1055.012 Process Injection: Process Hollowing; T1070.004 Indicator Removal: File Deletion; T1127.001 MSBuild; T1140 Deobfuscate/Decode Files or Information; T1620 Reflective Code Loading
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1047 Windows Management Instrumentation; T1059.001 Command and Scripting Interpreter: PowerShell; T1059.007 Command and Scripting Interpreter: JavaScript; T1204 User Execution; T1204.002 Malicious File
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1105 Ingress Tool Transfer; T1571 Non-Standard Port; T1573.001 Encrypted Channel: Symmetric Cryptography
Discovery
T1082 System Information Discovery; T1083 File and Directory Discovery; T1518 Software Discovery; T1518.001 Security Software Discovery
Credential Access
T1539 Steal Web Session Cookie; T1552.001 Unsecured Credentials: Credentials In Files; T1555 Credentials from Password Stores; T1555.003 Credentials from Password Stores: Credentials from Web Browsers
Initial Access
T1566 Phishing; T1566.001 Spearphishing Attachment
defense-impairment
Affected products and versions in JavaScript-Driven PureLogs Infostealer Variant Delivered via
- Microsoft — Windows (all supported versions)
Vulnerable versions: Windows 10; Windows 11; Windows Server 2016+ - Microsoft — .NET Framework (MsBuild.exe LOLBin abuse)
Vulnerable versions: v4.0.30319
Remediation for JavaScript-Driven PureLogs Infostealer Variant Delivered via
Immediate actions
- Block C2 IP 77.83.39.211 on port 8443 at perimeter firewalls and proxies
- Hunt EDR telemetry for MsBuild.exe processes with no project-file argument and outbound network connections
- Hunt for wscript.exe spawning powershell.exe with -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden
- Quarantine endpoints with files matching SHA-256 hashes from the IOC list
- Search mail gateways for inbound RAR attachments named PO*.rar from external senders to finance/procurement
- Reset credentials, browser-stored passwords, and Discord tokens for any user that executed kpankocrs.js
Workarounds
- Re-associate .js file extension to notepad.exe instead of wscript.exe on user workstations
- Block PowerShell ExecutionPolicy Bypass via GPO and Constrained Language Mode
- Network segmentation: prevent finance/procurement endpoints from making arbitrary outbound TLS to non-allowlisted IPs
Longer-term hardening
- Disable Windows Script Host (.js/.vbs) execution via registry or AppLocker where no business need exists
- Block or sandbox RAR/ZIP attachments containing executable scripts at the email gateway
- Enforce ASR (Attack Surface Reduction) rule: Block Office applications from creating child processes; Block executable content from email client
- Deploy EDR detections for reflective .NET assembly loading and process hollowing primitives (CreateProcessA + suspended + ZwUnmapViewOfSection + VirtualAllocEx)
- Restrict MsBuild.exe execution via WDAC or AppLocker to developer machines only
- User-awareness training focused on purchase-order and invoice-themed social engineering
Weaknesses (CWE) in JavaScript-Driven PureLogs Infostealer Variant Delivered via
CWE-94, CWE-829, CWE-506
Timeline of JavaScript-Driven PureLogs Infostealer Variant Delivered via
- FortiGuard Labs telemetry begins observing purchase-order-themed phishing emails carrying PO 2026-P0803.rar attachments
- Obfuscated JavaScript loader kpankocrs.js (SHA-256 3D510977...) extracted and analyzed; identified as multi-stage dropper writing PowerShell to C:\Temp
- MAFF.ProcessHollowing .NET module recovered from in-memory PowerShell stage; confirmed process hollowing into MsBuild.exe via CreateProcessA/ZwUnmapViewOfSection/VirtualAllocEx primitives
- C2 infrastructure identified at 77.83.39.211:8443 with URI paths /ping, /plugin, /userinfo, /browser, /discord, /crypto, /application, /filesearch/req, /finish
- Final-stage plugin (zgSGkYYzqVe.dll SHA-256 07CD03E2...) classified as a fileless variant of the PureLogs commodity infostealer
- Threadlinqs Intelligence opens tracking under TL-2026-0591 for SOC consumption
- FortiGuard Labs publishes public technical analysis of the JavaScript-driven PureLogs variant campaign
- As of 2026-05-29, this PureLogs JS variant (FortiGuard-disclosed 2026-05-26, no CVE) remains active: C2 77.83.39.211:8443 shows no public takedown and PureLogs MaaS is still sold (~$150/mo) and evolving via multiple 2026 campaigns. The MsBuild process-hollowing LOLBin technique stays fully viable, so it is a live, ongoing concern.
Sources cited for JavaScript-Driven PureLogs Infostealer Variant Delivered via
- Phishing Campaign Deploys JavaScript-Driven PureLogs Variant to Steal Sensitive Data
- MITRE ATT&CK T1055.012 - Process Hollowing
- MITRE ATT&CK T1218 - System Binary Proxy Execution (MsBuild)
- LOLBAS - MsBuild.exe
- MITRE ATT&CK T1059.001 - PowerShell
- MITRE ATT&CK T1059.007 - JavaScript
- PureLogs Stealer - Malpedia
Threats related to JavaScript-Driven PureLogs Infostealer Variant Delivered via
- Operation Turb00: Multi-Stage HijackLoader (IDAT Loader) Campaign Delivers Vidar v2.1 Infostealer and SnappyClient RAT via PNG-IDAT Steganography
- Fake Google/Cloudflare Verification Pages Spread Multiple Malware Families via ClickFix (HijackLoader, StealC, Remus Stealer, Amatera Stealer, CastleLoader, NetSupport RAT, ResiLoader)
- SnappyClient RAT — C++ C2 Implant Delivered via HijackLoader (Operation Turb00 Part 3)
- ClickFix Campaigns Deploy PavinLoader With Blockchain-Based C2 and Amatera Stealer
- Exposed Server Reveals AI-Assisted WebDAV Phishing Kit Targeting Mexican Users (CVE-2025-33053)
- Vidar Stealer 2.0 (Loadbaks) Distributed via Fake Game Cheats on GitHub and Reddit
Detection coverage for TL-2026-0591
As of 2026-05-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0591 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.