Back Scworld

AI used in PureRAT malware campaign

Scworld • January 30, 2026

AI-powered code has been leveraged by a Vietnamese threat actor to deliver PureRAT malware and other illicit payloads as part of a fake job phishing campaign initially discovered by Trend Micro in December, reports GBHackers News .

Malicious emails with job-themed lures have been used to redirect targets to Dropbox-hosted ZIP and RAR archives purporting to be for marketing, strategy, and project management roles in well-known brands, which contain illicit HR-related executables, according to an analysis from the Symantec and Carbon Black Threat Hunter Team. Running the executables sideloads DLLs that load nefarious AI-based batch scripts, which facilitate the deployment of PureRAT and HVNC payloads for remote credential compromise and lateral network movement.

Such batch scripts are believed to have been written using AI due to their presence of emojis in , a step-like structure, and clean error handling, said researchers, who recommended increased caution on unwanted job offers.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

AI-Driven Phishing Campaign Distributing PureRAT Malware A Vietnamese threat actor is utilizing AI to create code for a phishing campaign that delivers PureRAT malware and other malicious payloads. The campaign targets individuals with job-themed emails, luring them to open attachments that contain harmful executables. This tactic indicates a trend where lower-skilled attackers are leveraging AI to enhance their attack capabilities. 2 sources 34

Extracted Entities

AI used in PureRAT malware campaign

The full story

Extracted Entities

Attack Types (2)

Malware (2)

Tools (1)