Fileless Stealer and PureRAT Raid Browser Passwords, Telegram Sessions, and Crypto Wallets

This report describes a sophisticated, active campaign in which operators maintained a WebDAV-backed "malware delivery lab" and used AI-assisted lure generation and QA pipelines to deliver fileless stealers and a modular PureRAT backdoor; the operation targeted browser credentials, Telegram sessions, desktop wallets, and other financial artifacts, leveraged multiple CVE-based hijack vectors and LOLBin execution, and produced substantial telemetry and IOCs tied primarily to Mexican users.