PureHVNC RAT Developers Exploit GitHub to Spread Pure Malware Source Code

The PureHVNC RAT developers have been found using GitHub repositories to host critical components and plugin source code for their Pure malware family, according to Check Point Research. In an eight-day ClickFix intrusion campaign, the RAT’s command-and-control server delivered GitHub URLs to infected machines, linking these accounts to the malware author known as PureCoder.

The incident involved a mid-2025 phishing campaign that used a PowerShell payload masquerading as a fake job listing, with the initial loader written in Rust and deploying PureHVNC RAT identified by campaign identifiers “2a” and “amazon3.” During the eight-day intrusion, two instances of PureHVNC RAT were deployed, persistence was established, and the Sliver C2 framework was executed, with the RAT exfiltrating system information over SSL in compressed payloads of up to 16 KB.

The researchers traced GitHub accounts named testdemo345 and DFfe9ewf/PURE-CODER-1 to PureCoder, and noted that these repositories contained executable modules and plugin sources for TwitchBot and YoutubeBot extensions.