Cybercriminals are increasingly moving away from obvious malware delivery techniques and adopting stealthier methods designed to bypass modern endpoint defenses. One of the fastest-growing tactics in today’s threat landscape is steganography-based malware delivery, where malicious payloads are hidden inside seemingly harmless files such as images, media assets, or documents. Recent research from FortiGuard Labs revealed a sophisticated phishing campaign leveraging this exact technique through a malware loader known as PawsRunner, which ultimately deploys the .NET infostealer PureLogs.
Initial Access Through Social Engineering and Archive-Based Delivery
The attack chain begins with a carefully crafted phishing email using invoice-themed social engineering tactics to create urgency and pressure recipients into opening a malicious attachment. Instead of distributing a traditional executable file, attackers use a TXZ archive, an XZ-compressed TAR file format that appears less suspicious to users and security tools alike. Once extracted, the archive contains a malicious JavaScript file heavily obfuscated with multilingual comments in Chinese, Japanese, Korean, Russian, Hindi, and Arabic to complicate static analysis and evade detection mechanisms.
The JavaScript establishes multiple environment variables containing encrypted command fragments and launches conhost.exe in hidden mode alongside PowerShell using the -w hidden parameter. This approach conceals execution from the victim while preparing the next-stage payload. The PowerShell component reconstructs malicious content from environment variables, decrypts the data using AES encryption, decompresses it through Gzip, and dynamically loads a .NET assembly directly into memory using reflection. This fully fileless execution chain significantly reduces forensic artifacts and complicates endpoint detection and response activities.
PawsRunner: A Steganography-Based Malware Loader
The decrypted .NET assembly acts as the PawsRunner loader, which demonstrates a highly modular architecture. Interestingly, researchers observed that the malware frequently uses cat images and cat-themed icons as part of its disguise strategy. During initialization, the loader decrypts configuration values including payload URLs, user-agent strings, magic numbers, and encryption seeds. It also resolves critical API addresses and loads required native libraries dynamically to avoid static detection.
One of the most advanced characteristics of PawsRunner is its adaptive download logic. The malware rotates between multiple networking APIs including HttpClient, WebClient, and WebRequest, while also cycling through several hardcoded user-agent profiles to imitate legitimate traffic patterns. More importantly, the malware manipulates HTTP Accept headers to prioritize image/png responses, explicitly encouraging servers to deliver PNG image files instead of executable content.
The downloaded content may appear as standard HTML, Base64-encoded data, or legitimate PNG images. If an image is received, the loader extracts hidden encrypted payloads embedded within PNG metadata structures such as the iTXt and IEND chunks. This is where steganography becomes central to the attack chain. The concealed payload is decrypted and transformed into another .NET executable that continues the infection process. This method enables attackers to transport malware through ordinary-looking media files that often bypass content filtering and network inspection systems.
PureLogs Infostealer and Advanced Credential Theft
The final payload delivered by PawsRunner is PureLogs, a well-known .NET-based infostealer developed within the Pure malware ecosystem. PureLogs uses .NET Reactor obfuscation alongside Protobuf serialization to protect configuration data and complicate reverse engineering efforts. The malware decrypts resource-only assemblies using TripleDES and Gunzip before loading additional downloader components into memory.
Once operational, PureLogs retrieves configuration parameters such as AES keys, mutex values, build identifiers, and command-and-control server addresses. The malware establishes encrypted HTTPS communication with endpoints like /ping and /plugin before downloading additional encrypted modules protected with AES-256-CBC encryption. After decompression and memory injection, the core credential theft routines are activated.
The scale of data collection is particularly alarming. PureLogs targets an enormous range of Chromium-based and Gecko-based browsers, cryptocurrency wallets, password managers, authenticator applications, VPN clients, email software, gaming applications, and communication platforms such as Discord, Telegram, and Signal. The malware also enumerates browser extensions linked to major cryptocurrency ecosystems including MetaMask, Trust Wallet, Phantom, Coinbase Wallet, Keplr, Ronin, Binance Chain Wallet, and dozens of others. Harvested data is compressed, encrypted with AES, and transmitted to multiple HTTP endpoints including /browser, /crypto, /discord, /application, and /filesearch/res.
Our Opinion on the Threat Landscape Evolution
The PawsRunner and PureLogs campaign highlights a dangerous evolution in modern malware operations. Threat actors are no longer relying solely on traditional malicious executables or simple phishing attachments. Instead, they are combining social engineering, fileless execution, encrypted staging, and steganography to create highly evasive attack chains capable of bypassing conventional antivirus and network defenses. The use of PNG images as malware carriers is especially concerning because image traffic is generally considered trustworthy in most enterprise environments.
What makes this campaign particularly significant is its operational maturity. The attackers implemented fallback download logic, dynamic API resolution, encrypted memory execution, asynchronous communication models, and advanced credential harvesting capabilities across browsers, wallets, VPNs, and messaging platforms. This demonstrates a clear shift toward modular malware ecosystems designed for persistence, scalability, and stealth.
Organizations should view campaigns like this as evidence that traditional perimeter defenses are no longer sufficient. Security teams must prioritize behavioral detection, memory analysis, PowerShell monitoring, and network anomaly detection. Additionally, phishing awareness training remains essential because the entire attack chain still begins with human interaction. The rise of steganography-based malware delivery also reinforces the need for deeper inspection of seemingly benign media files moving across enterprise environments.
