PureRAT Hides PE Payloads in PNGs for Fileless Execution

Gbhackers •Mayura Kathir • April 21, 2026

A multi-stage PureRAT campaign that hides portable executable (PE) payloads inside PNG images and executes them almost entirely in memory, making detection and forensics significantly harder for defenders. The campaign combines steganography, PowerShell-based loaders, UAC bypass, process hollowing, and anti-virtualization checks to remain stealthy on compromised systems. The attack begins with a weaponized .LNK file […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

PureRAT Campaign Uses PNGs for Stealthy Fileless Attacks A new malware campaign utilizing the PureRAT remote access trojan (RAT) has been identified, targeting Windows systems. This sophisticated attack hides malicious portable executable (PE) payloads within PNG image files, allowing for fileless execution that significantly complicates detection efforts. The campaign employs advanced techniques such as steganography, PowerShell-based loaders, UAC bypass, process hollowing, and anti-virtualization checks to evade security measures. The initial infection vector is a weaponized .LNK file that initiates the attack. As the malware operates entirely in memory, it leaves minimal traces on compromised systems, making forensic analysis challenging. Organizations using Windows systems are particularly vulnerable to this stealthy threat. The current status of the campaign indicates ongoing activity, with no specific mitigation strategies disclosed in the articles. 2 sources 62

Extracted Entities

PureRAT Hides PE Payloads in PNGs for Fileless Execution

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (5)

Tools (1)