Back Feeds2.Feedburner

PureLogs infostealer is stealing credentials worldwide

Feeds2.Feedburner •Zeljka Zorz • May 19, 2026

A phishing campaign is smuggling the powerful PureLogs information stealer onto targets’ Windows machines by hiding encrypted malicious payloads inside cat photos, Fortinet researchers discovered. The attack The attack starts with a phishing email containing a TXZ archive and using an invoice-themed lure to pressure the victim into opening it quickly: The phishing email carrying the malicious TXZ archive (Source: Fortinet) The extracted JavaScript stores malicious commands in process environment variables (which are also filled … More →

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

PureLogs Infostealer Campaign Targets Users via Phishing with Cat Photos A new phishing campaign is distributing the PureLogs infostealer, which targets Windows machines. The attack begins with an email containing a TXZ archive disguised as an urgent invoice, compelling victims to open it quickly. Once extracted, the archive reveals a JavaScript file that executes malicious commands. This tactic of hiding malware in seemingly harmless files is becoming increasingly common among threat actors. The campaign has been confirmed by Fortinet researchers, indicating a widespread impact on users globally. Specific numbers on affected users or systems were not disclosed in the articles. The attack exploits social engineering to increase the likelihood of user interaction with the malicious payload. The current status of the campaign remains active as of May 19, 2026. 2 sources 52

Extracted Entities

PureLogs infostealer is stealing credentials worldwide

The full story

Extracted Entities

Attack Types (2)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)