New PureRAT Campaign Uses PNG Files To Conceal Fileless Payloads

Trellix researchers report a sophisticated PureRAT campaign that begins with a malicious .LNK and VBS loader to download PNG images containing steganographically embedded, obfuscated PE payloads; the attack performs in-memory PowerShell loading (fileless execution), UAC bypass via cmstp.exe, process hollowing, and persistent scheduled tasks, and the report includes SHA256 IOCs and a C2 domain for detection and blocking.