PURELOGS Payload Hidden in Weaponized PNG Images Used in Stealth Attacks

Gbhackers •Mayura Kathir • January 21, 2026

A sophisticated PURELOGS infostealer campaign that weaponizes PNG image files to evade detection.The attack begins with a phishing email disguised as a pharmaceutical invoice containing a ZIP archive with a JScript (.js) file. Unlike browser-based JavaScript, this Windows Script Host file executes with full operating system privileges through the Windows scripting engine, granting direct access […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

PURELOGS Infostealer Campaign Utilizes Weaponized PNG Files A sophisticated attack campaign has been identified where the PURELOGS infostealer is delivered via weaponized PNG files. The campaign initiates with phishing emails disguised as pharmaceutical invoices, leading to the execution of a malicious JScript file that operates with full system privileges. This method allows threat actors to evade detection systems effectively. 2 sources 36

Extracted Entities

PURELOGS Payload Hidden in Weaponized PNG Images Used in Stealth Attacks

The full story

Extracted Entities

Attack Types (2)

Malware (1)

MITRE ATT&CK (2)

Platforms (1)

Tools (1)