Threat Actors Hiding stealthy PURELOGS Payload Within a Weaponized PNG File

Cybersecuritynews •Tushar Subhra Dutta • January 21, 2026

A newly discovered attack campaign has exposed a sophisticated delivery method for the PURELOGS infostealer, a commodity malware sold as a service on underground forums. Threat actors are using weaponized PNG files hosted on legitimate infrastructure to deliver the payload while evading detection systems. The campaign begins with deceptive phishing emails disguised as pharmaceutical invoices, […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

PURELOGS Infostealer Campaign Utilizes Weaponized PNG Files A sophisticated attack campaign has been identified where the PURELOGS infostealer is delivered via weaponized PNG files. The campaign initiates with phishing emails disguised as pharmaceutical invoices, leading to the execution of a malicious JScript file that operates with full system privileges. This method allows threat actors to evade detection systems effectively. 2 sources 36

Extracted Entities

Threat Actors Hiding stealthy PURELOGS Payload Within a Weaponized PNG File

The full story

Extracted Entities

Attack Types (2)

Malware (1)

MITRE ATT&CK (1)