New PureRAT Campaign Hides PE Payloads in PNG Files and Executes Them Filelessly

Cybersecuritynews •Tushar Subhra Dutta • April 21, 2026

A new and sophisticated malware campaign has been discovered, using a remote access trojan (RAT) called PureRAT to silently compromise Windows systems. What makes this campaign stand out is how cleverly it hides malicious code inside ordinary-looking PNG image files. Once the infection takes hold, the malware runs entirely in memory, leaving almost no traces […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

PureRAT Campaign Uses PNGs for Stealthy Fileless Attacks A new malware campaign utilizing the PureRAT remote access trojan (RAT) has been identified, targeting Windows systems. This sophisticated attack hides malicious portable executable (PE) payloads within PNG image files, allowing for fileless execution that significantly complicates detection efforts. The campaign employs advanced techniques such as steganography, PowerShell-based loaders, UAC bypass, process hollowing, and anti-virtualization checks to evade security measures. The initial infection vector is a weaponized .LNK file that initiates the attack. As the malware operates entirely in memory, it leaves minimal traces on compromised systems, making forensic analysis challenging. Organizations using Windows systems are particularly vulnerable to this stealthy threat. The current status of the campaign indicates ongoing activity, with no specific mitigation strategies disclosed in the articles. 2 sources 62

Extracted Entities

New PureRAT Campaign Hides PE Payloads in PNG Files and Executes Them Filelessly

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Malware (1)

Platforms (1)