A phishing campaign is using a malicious JavaScript attachment to decrypt and execute a PowerShell script. That script then performs process hollowing to inject a .NET downloader into the trusted MsBuild.exe process. The downloader reaches out to a command-and-control server to retrieve a PureLogs plugin that steals credentials, browser data, cryptocurrency wallet information, and other sensitive assets. The attack chain is highly evasive and relies on layered encryption together with fileless execution techniques to reduce detection.
FortiGuard Labs examined the email attachment, the obfuscated JavaScript, the dropped PowerShell script, and the in-memory .NET components used later in the attack. During analysis, researchers observed creation of a hollowed MsBuild.exe process, loading of a downloader DLL, and execution of a PureLogs plugin that harvested data from browsers, Discord, crypto wallets, and other applications. Captured network traffic showed encrypted GET and POST communications with a single command-and-control server.
The report recommends enforcing strong email filtering, limiting script execution wherever feasible, and monitoring for suspicious PowerShell activity and process hollowing involving MsBuild.exe . It also advises using endpoint detection and response tools that can identify in-memory .NET assemblies and unusual outbound network behavior associated with staged malware delivery.
If this activity is detected, isolate the affected endpoint, terminate the malicious MsBuild.exe process, and block the command-and-control IP address. Investigators should then perform forensic analysis to determine whether any credentials or sensitive data were stolen and reset exposed accounts as needed. Detection content should also be updated to cover PowerShell abuse, process hollowing, and PureLogs-related behavior.
Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.
Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.
Attack Narrative & Commands:
Regression Test Script: (PowerShell – run as a normal user, requires no external files)
Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
