PureLogs

Attacks that leverage malicious open-source packages are becoming a major and growing threat... We analyzed the code of every version of this extension and confirmed that it was a fake... All it does is download and execute malicious code from the aforementioned web server.

Security researchers have uncovered a series of highly sophisticated Fluffy Wolf phishing attacks targeting Russian organizations across various critical sectors.

The infection chain begins with targeted social engineering messages sent directly to company personnel. Threat actors carefully disguise these malicious emails as urgent corporate purchase orders. For instance, the message instructs recipients to open a compressed file named PO 2026-P0803.rar to check an invoice.

...а в других случаях жертве предоставляли ссылку на GitHub-репозиторий, откуда загружался RAR-архив. По словам исследователей, Fluffy Wolf активно использует GitHub, потому что такие ссылки выглядят легитимно и помогают обходить почтовые фильтры...

If the victim extracts the archive, they find a script component called kpankocrs.js... Subsequently, the script launches an active PowerShell process with an execution policy bypass flag to run the code silently.

This screenshot clearly shows the code requesting and executing a PowerShell script from the web server angelic[.]su... when the malicious plugin was activated, it downloaded a PowerShell script from https://angelic[.]su/files/1.txt.

Further analysis revealed that the attackers used ScreenConnect to upload three VBScripts to the compromised machine: Each of these downloaded a PowerShell script from the text-sharing service paste.ee.

If the victim extracts the archive, they find a script component called kpankocrs.js. When executed, this malicious JavaScript file extracts a secondary encrypted shell file.

Specifically, the code targets the native utility MsBuild.exe located within the Microsoft .NET Framework folders.

To remain hidden, the threat actors inject these payloads into trusted Windows processes such as RegAsm.exe, InstallUtil.exe, and MSBuild.exe.

The fileless script uses a custom wrapper block to run process hollowing against a trusted system file. Specifically, the code targets the native utility MsBuild.exe located within the Microsoft .NET Framework folders.

To hide its footprint, the delivery pipeline utilizes multiple advanced encryption layers and fileless components... This dynamic tool relies on commercial runtime packing software to prevent static analysis by defensive teams.

To remain hidden, the threat actors inject these payloads into trusted Windows processes such as RegAsm.exe, InstallUtil.exe, and MSBuild.exe.

The fileless script uses a custom wrapper block to run process hollowing against a trusted system file. Specifically, the code targets the native utility MsBuild.exe located within the Microsoft .NET Framework folders.

Specifically, the code targets the native utility MsBuild.exe located within the Microsoft .NET Framework folders.

This hidden payload decodes an embedded assembly binary in host memory using an XOR rotation method.

The attack uses Donut shellcode, fileless execution, RWX memory allocation, and in-memory .NET assembly loading to evade detection.

Similarly, the malware interrogates specific system directories to capture authentication tokens from messaging applications. It targets multiple Discord releases to perform unauthorized account takeovers without requiring passwords.

Once executed, PureLogs steals browser credentials, Windows secrets, cryptocurrency wallet data, password manager information, and session tokens.

The PureLogs stealer actively harvests vast amounts of sensitive data, sweeping up browser credentials...

With these tools, the attackers successfully obtained passphrases for the developer’s wallets and then syphoned off cryptocurrency.

Moreover, the agent scans local registry keys to harvest private keys from popular cryptocurrency wallets.

First, it takes interactive screenshots and scrapes detailed hardware properties like processor configurations. In addition, the spyware reads local clipboard balances and searches for security software details.

Stealer that collected data from browsers, email clients, and crypto wallets (via m.vbs).

First, it takes interactive screenshots...

In addition, the spyware reads local clipboard balances...

Fluffy Wolf operators streamline their campaigns by categorizing this stolen data and routing it to dedicated server endpoints for easier monetization.

Both implants communicated with the C2 server 144.172.112[.]84, which resolved to relay.lmfao[.]su at the time of our analysis.

To confirm server availability, the system sends a standard network request to a designated URL endpoint. For instance, the downloader invokes an asynchronous web client to ping the controller IP address.

Once PowerLoader infiltrates a target host, it spawns hidden PowerShell instances to retrieve additional malicious scripts directly from the command-and-control (C2) server. These scripts systematically deploy the final payloads...

The malware also establishes TCP-based C2 communication to exfiltrate stolen data and receive attacker-controlled configurations.