PureLogs Malware Variant Abuses MSBuild.exe for Process Hollowing Attacks

A sophisticated phishing campaign distributing a highly evasive variant of the PureLogs malware, which tricks victims into opening malicious attachments that silently compromise their machines.

The attackers cleverly abuse legitimate Windows tools, specifically MSBuild.exe, to hide their tracks while aggressively stealing sensitive information like cryptocurrency wallets, browser passwords, and system data.

The attack begins with a deceptive email pretending to be a purchase order. It carries a RAR archive attachment named similarly to “PO 2026-P0803.rar.”

Because the email appears to be a standard business request, unsuspecting employees are lured into opening the file.

PureLogs Abuses MSBuild Process

Once the victim opens the archive, an obfuscated JavaScript file is executed. This script acts as the first domino in the attack sequence.

It secretly decrypts a hidden PowerShell script and drops it into a temporary folder on the system.

To avoid raising alarms, the JavaScript code then uses a hidden window to run this newly created PowerShell file. Hence, the user never sees a command prompt appear on their screen.

The PowerShell script contains a massive block of encoded data that it decodes directly in memory.

This creates a fileless attack, meaning the core malicious code never actually rests on the computer’s hard drive, where security scanners typically look. The script then performs a technique known as process hollowing.

Think of process hollowing like a digital disguise; the malware creates a paused version of a safe, trusted Windows process (in this case, the Microsoft .NET framework tool MsBuild.exe), scoops out its legitimate code, and replaces it with the malicious payload.

Operating safely under the guise of MsBuild.exe, the malware’s downloader module connects to its Command and Control (C2) server.

It verifies the connection with a simple ping request before downloading the primary weapon: a fileless PureLogs plugin. Commercial obfuscation tools heavily protect this plugin to frustrate security analysts and block reverse engineering attempts.

According to Fortinet research, it begins a massive sweep of the infected device. Its primary goal is to harvest as much valuable data as possible.

The malware gathers basic system details, such as the operating system version, running processes, and screen resolution, and even takes a screenshot of the desktop.

It then compresses all this stolen data into a smaller file, encrypts it with military-grade AES, and sends it back to the attackers via a secure HTTP POST request.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.