PawsRunner Loader Uses Steganography To Deploy PureLogs Infostealer

FortiGuard Labs reported a phishing campaign in which attackers send a TXZ attachment that launches a fileless .NET loader (PawsRunner) via hidden PowerShell environment variables; PawsRunner retrieves PNG “cat” images containing encrypted payloads via steganography to deploy the PureLogs infostealer, which harvests browser credentials, password manager data, recovery phrases/private keys, and specific crypto wallet extension data (several extension IDs are provided).