Hackers Hide PureLogs Infostealer in PawsRunner Loader

FortiGuard-investigated phishing campaign delivers a .NET loader called PawsRunner (disguised with cat icons) via TXZ attachments and JavaScript-driven PowerShell; PawsRunner prioritizes PNG responses and extracts encrypted payloads hidden in PNG chunks (steganography) to deploy the PureLogs infostealer, which harvests browsers, wallets, credentials and other sensitive data and exfiltrates it to C2 endpoints. Indicators (defanged IP, URL, multiple SHA256 hashes) and descriptions of persistence, RC4/RC4-like decryption, AES/TripleDES payload handling, in-memory execution, and evasion techniques are included.