Business Email Scams Evolve to Deliver PureRAT and PureLogs Malware
Attackers are weaponizing common business communications about delivery issues and refunds to trick recipients into downloading malicious ZIP archives containing data-stealing malware.
Cybercriminals are increasingly transforming mundane business correspondence into sophisticated phishing lures, a trend highlighted by a recent campaign observed between July and August 2026. These attacks leverage seemingly legitimate messages concerning delivery problems or refund requests to trick unsuspecting employees into downloading malicious ZIP archives. The campaign, which primarily used Japanese and Korean language lures, suggests a broad targeting scope across East and Southeast Asia, with landing pages offering content in multiple languages.
The core of the attack involves directing victims to fake document-sharing or video-viewing websites. These sites, designed to appear legitimate, claim that files are too large for preview and prompt users to download a ZIP archive. This archive, upon extraction, contains malware such as PureRAT, a remote access tool, or PureLogs, an information stealer. Both malware families are capable of exfiltrating sensitive business data and establishing persistent access for attackers.
ITOCHU Cyber & Intelligence Inc. researchers noted that the attackers employed a variety of loaders and techniques to evade detection. The infection chain often involves layered obfuscation, including bundled Python software, modified Donut loaders, and in-memory execution, making simple file-based blocking ineffective. Some variants also employ techniques like double extensions on executables to disguise them as common document types, further complicating detection.
Further complicating defenses, the malware utilizes advanced evasion tactics. One observed method involved using a legitimate, Microsoft-signed program to load a malicious DLL, hidden and padded with extraneous data to bypass file-size limits in security tools. Attackers also manipulate Windows features for persistence, creating Startup shortcuts, scheduled tasks, or Registry entries, and some variants attempt to disable security software by abusing trusted drivers, a tactic reminiscent of advanced persistent threat operations.
The impact of these attacks extends beyond initial data theft. PureRAT can gather extensive system information, including operating system details, active windows, user credentials, security product status, and even webcam feeds, before exfiltrating data from browsers, cryptocurrency wallets, and messaging applications. PureLogs focuses on collecting browser cookies, Discord data, screenshots, and file search results, providing attackers with a comprehensive view of a victim's digital life.
Defenders are urged to implement a multi-layered security approach. This includes scrutinizing email headers for suspicious Reply-To addresses, blocking known malicious indicators, and educating employees to verify unexpected requests requiring downloads through separate, trusted channels. Network security teams should monitor for unusual driver installations, new services, scheduled tasks, and failed security processes, as these can indicate a compromise.
The evolving nature of these attacks, with constantly changing loaders and obfuscation techniques, underscores the unreliability of solely relying on file hashes for detection. A combination of email filtering, behavior monitoring, and robust employee reporting mechanisms is crucial for effective protection against these sophisticated business email compromise schemes.