New PureLogs Variant Abuses MSBuild to Evade Detection

Gbhackers •Mayura Kathir • May 28, 2026

A new phishing-driven malware campaign distributing a stealthy PureLogs variant that leverages advanced evasion techniques, including process hollowing via MsBuild.exe. The campaign is designed to steal sensitive data from infected systems while avoiding traditional detection mechanisms through layered obfuscation and fileless execution. The attack begins with phishing emails disguised as purchase orders, a familiar social […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Phishing Campaign Deploys PureLogs Variant via JavaScript and MsBuild Injection A new phishing campaign has been identified that distributes a variant of the PureLogs infostealer malware through deceptive purchase-order-themed emails. The campaign utilizes a malicious JavaScript file contained in a RAR archive, which, when executed, decrypts and runs a PowerShell script. This script employs process hollowing to inject a .NET downloader into the legitimate MsBuild.exe process, allowing it to evade detection. The downloader retrieves a PureLogs plugin that collects sensitive data, including browser credentials, cryptocurrency wallet information, and application credentials. The attack primarily targets Windows users and leverages advanced evasion techniques to minimize detection risks. FortiGuard Labs has provided detailed analysis and indicators of compromise (IoCs) for this campaign. Organizations are advised to enhance email filtering, restrict script execution, and monitor for unusual PowerShell activity. The campaign has been confirmed to be active as of May 2026. 7 sources 71

Extracted Entities

New PureLogs Variant Abuses MSBuild to Evade Detection

The full story

Extracted Entities

Attack Types (2)

Malware (1)

MITRE ATT&CK (2)

Tools (1)