Live
—
eineurope/
Home/Uncategorized/Topic Ā· šŸ”« PureRAT Campaign Embeds Fileless Payloads in PNG Files T…
Uncategorized21 Apr

šŸ”« PureRAT Campaign Embeds Fileless Payloads in PNG Files Trellix Advanced Rese...

šŸ”« PureRAT Campaign Embeds Fileless Payloads in PNG Files Trellix Advanced Research Center has identified a sophisticat.

Sources
1 verified
Location
—
Updated
Tuesday, 21 April 2026 at 11:25 UTC
No media Ā· text-only dispatch
Synthesis Ā· 1 sources
šŸ”« PureRAT Campaign Embeds Fileless Payloads in PNG Files Trellix Advanced Research Center has identified a sophisticated PureRAT operation that conceals malicious PE files within PNG images using steganography. The multi-stage attack chain begins with a malicious .LNK file triggering obfuscated VBScript, which establishes persistence via Windows Task Scheduler and downloads weaponized PNG files from crixup[.]com. The campaign demonstrates advanced evasion through UAC bypass via cmstp.exe, anti-VM checks, and process hollowing into legitimate msbuild.exe. According to Trellix researchers, the fileless execution technique combined with living-off-the-land binaries renders traditional endpoint defenses largely ineffective. šŸ›°ļø Open sources - closed narratives @sitreports
e/eineurope Ā· topic Ā· T-02976