# JavaScript-Driven PureLogs Infostealer Variant Delivered via Purchase-Order Phishing with Process Hollowing into MsBuild.exe

> FortiGuard Labs has documented an active phishing campaign delivering an obfuscated JavaScript loader (kpankocrs.js) inside purchase-order-themed RAR attachments. The loader drops a PowerShell script, which decrypts an in-memory .NET module that performs process hollowing into the signed Microsoft binary MsBuild.exe to deploy a downloader and ultimately load a fileless PureLogs infostealer plugin from C2 77.83.39.211:8443.

- **Published:** 2026-05-26T00:00:00Z
- **Last reviewed:** 2026-05-26T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0591
- **ID:** TL-2026-0591
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)

## Description

## Overview

FortiGuard Labs disclosed (26 May 2026) a phishing operation distributing a new JavaScript-driven variant of the PureLogs commodity infostealer. The campaign relies on social-engineering bait that mimics business-to-business purchase-order correspondence, attaching a RAR archive (PO 2026-P0803.rar) containing a heavily obfuscated JavaScript file (kpankocrs.js). Upon execution by wscript.exe, the loader writes a random-named PowerShell script (ps_*.ps1) to C:\Temp and launches it with bypass parameters. The PowerShell stage Base64-decodes and XOR-with-rotation-decrypts an embedded .NET assembly (MAFF.ProcessHollowing), which it loads reflectively via Invoke-AssemblyMethod. MAFF.ProcessHollowing creates a suspended instance of the Microsoft .NET Framework's MsBuild.exe (C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe), unmaps its original image, allocates RWX memory, writes a runtime payload (Iwnflr.exe SHA-256 B90988400C...), restores the thread context, and resumes execution — classic Stuxnet-style process hollowing into a signed LOLBin.

## Stage 2 - Downloader (Iwnflr.exe)

The hollowed MsBuild.exe now hosts Iwnflr.exe, a .NET downloader that decrypts a DES-encrypted internal configuration block to recover its C2 endpoint (77.83.39.211:8443) and an AES key. The downloader issues an HTTPS GET to /ping for health-check, then POSTs an AES-encrypted host fingerprint to /plugin. The C2 returns the next-stage plugin payload — Rmiyj.dll (SHA-256 E20B35A8...) — which loads reflectively in the same hollowed MsBuild.exe process. No second-stage binary is written to disk; the chain remains fileless from the PowerShell stage forward.

## Stage 3 - PureLogs Infostealer Plugin (zgSGkYYzqVe.dll)

The final plugin (zgSGkYYzqVe.dll SHA-256 07CD03E2...) is a fileless variant of the PureLogs infostealer. It harvests browser-stored credentials, cookies, autofill data, and history from Chromium and Gecko-based browsers; cryptocurrency wallet files for desktop wallets (Exodus, Atomic, Electrum, etc.); Discord tokens; FTP/email/VPN client credentials; and arbitrary user files matching attacker-supplied search terms. Collected data is AES-encrypted and exfiltrated via POSTs to C2 URI paths /userinfo, /browser, /discord, /crypto, /application, and /filesearch/req. The session is terminated by a GET to /finish.

## Why This Matters

The chain is notable for: (1) entirely fileless execution after the PowerShell loader, including in-memory .NET module loading and reflective DLL execution, (2) abuse of MsBuild.exe — a digitally signed Microsoft binary commonly allowlisted in EDR baselines — as a process-hollowing target, (3) DES + AES dual-layer crypto for configuration and traffic, evading naïve string-based detection, and (4) commodity-stealer-as-modular-plugin architecture where the loader and infostealer are independently swappable. The attack chain provides high-fidelity detection opportunities at multiple stages: wscript.exe -> powershell.exe parent-child relationships, MsBuild.exe spawned without a project file argument, MsBuild.exe with anomalous outbound network connections, and the specific URI-path beacon pattern.

## Recommended Posture

Block 77.83.39.211/32 at perimeter. Hunt for MsBuild.exe processes lacking project arguments, especially those with outbound TLS to non-Microsoft IPs. Disable .js script execution by Windows Script Host where business need does not require it. Mail-gateway block .rar attachments from external senders for finance/procurement mailboxes.

## MITRE ATT&CK

- T1566 Phishing
- T1566.001 Spearphishing Attachment
- T1204 User Execution
- T1204.002 Malicious File
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1047 Windows Management Instrumentation
- T1055.012 Process Injection: Process Hollowing
- T1055 Process Injection
- T1127.001 MSBuild
- T1620 Reflective Code Loading
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1685 Disable or Modify Tools
- T1070.004 Indicator Removal: File Deletion
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1555 Credentials from Password Stores
- T1539 Steal Web Session Cookie
- T1552.001 Unsecured Credentials: Credentials In Files
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1518 Software Discovery
- T1518.001 Security Software Discovery
- T1005 Data from Local System
- T1560 Archive Collected Data
- T1560.003 Archive via Custom Method
- T1071.001 Application Layer Protocol: Web Protocols
- T1573.001 Encrypted Channel: Symmetric Cryptography
- T1105 Ingress Tool Transfer
- T1571 Non-Standard Port
- T1041 Exfiltration Over C2 Channel

## Sources

- [Phishing Campaign Deploys JavaScript-Driven PureLogs Variant to Steal Sensitive Data](https://www.fortinet.com/blog/threat-research/phishing-campaign-deploys-javascript-driven-purelogs-variant-to-steal-sensitive-data)
- [MITRE ATT&CK T1055.012 - Process Hollowing](https://attack.mitre.org/techniques/T1055/012/)
- [MITRE ATT&CK T1218 - System Binary Proxy Execution (MsBuild)](https://attack.mitre.org/techniques/T1127/001/)
- [LOLBAS - MsBuild.exe](https://lolbas-project.github.io/lolbas/Binaries/Msbuild/)
- [MITRE ATT&CK T1059.001 - PowerShell](https://attack.mitre.org/techniques/T1059/001/)
- [MITRE ATT&CK T1059.007 - JavaScript](https://attack.mitre.org/techniques/T1059/007/)
- [PureLogs Stealer - Malpedia](https://malpedia.caad.fkie.fraunhofer.de/details/win.purelogs_stealer)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0591