Hidden in Plain Site: PURELOGS Stealer Hides Malware in Archive.org Images

In a January 2026 analysis, PureLogs stealer is shown to hide in Archive[.]org images as part of a four‑stage malware delivery chain, with Louis Schürmann, a Security Analyst at Swiss Post Cybersecurity, dissecting the campaign. The chain begins with a phishing email carrying a ZIP file that delivers a Windows Script Host JScript file, which then downloads a PNG from Archive[.]org that appears legitimate but is a polyglot file concealing a payload.

The Base64‑encoded payload sits after the IEND chunk and is extracted by a PowerShell script loaded into memory, a classic fileless technique that avoids touching disk. The four stages include a JScript Dropper, a modular VMDetectLoader, Process Hollowing of CasPol.exe, and a final Unpacker that decrypts the payload with 3DES.

The final PURELOGS payload targets browsers for passwords and cookies and seeks cryptocurrency across more than 30 desktop wallets and 70 browser extensions, with MaaS subscriptions advertised at as little as $150 a month.