PureHVNC RAT: Inside the HVNC Malware and the PureCoder Ecosystem

A forensic investigation by Check Point Research has shed light on the Pure malware family, a suite developed and sold by a threat actor known as PureCoder, and centres on a ClickFix phishing campaign that resulted in an eight-day intrusion involving a Rust Loader, PureHVNC RAT and the Sliver C2 framework.

The infection chain began with fake job advertisements that led victims to a ClickFix phishing page, where PowerShell commands were automatically copied to the clipboard and, if run, downloaded obfuscated JavaScript files that deployed the first PureHVNC RAT.

By day two, the attackers escalated by delivering a Rust-based loader that dropped another instance of PureHVNC RAT, this time with the campaign ID amazon3, while PureHVNC provides HVNC control and capabilities such as remote webcam and microphone access, keylogging and clipboard monitoring, and DDoS features. The investigation notes that PureHVNC and related malware frequently pulled files from GitHub repositories directly controlled by PureCoder, with commits tied to GitHub accounts in the UTC+0300 timezone.

PureCoder is believed to maintain a broad portfolio, including PureCrypter, PureLogs, PureMiner and Blue Loader, and the Rust Loader employed anti-analysis techniques and a 30-minute delay to evade sandbox detection, with persistence achieved by masquerading as a Google Updater. According to Check Point Research, these findings illuminate not only the technical depth of PureHVNC RAT but also the wider Pure malware ecosystem fuelling cybercrime operations.