Fluffy Wolf Phishing Attacks Push PowerLoader Malware

Fluffy Wolf conducted sophisticated phishing campaigns (Mar–May 2026) against Russian construction, consulting, manufacturing, engineering, retail and e‑commerce firms using malicious RARs, GitHub links and a newly observed PowerLoader MaaS downloader to deploy PureRAT (now with a Remote Desktop plugin), PureLogs stealer and Pay2Key ransomware; attackers use fileless PowerShell retrieval, inject payloads into trusted Windows processes, and employ anti‑forensic techniques to support theft and extortion.