Researchers Expose SVG and PureRAT Phishing Threats Targeting Ukraine and Vietnam

On 26 September 2025, researchers observed a new phishing campaign targeting Ukraine and Vietnam that impersonates government agencies to deliver CountLoader, which then drops Amatera Stealer and PureMiner. According to Fortinet FortiGuard Labs, the attack uses malicious Scalable Vector Graphics files designed to act as HTML substitutions, guiding victims to download a password‑protected ZIP containing a CHM file that unleashes CountLoader.

In this chain, CountLoader is used as a distribution vector for Amatera Stealer and PureMiner, while PureRAT and other PureCoder tools are linked to broader malware activity associated with the same operator. The campaign is noted to have targeted Ukrainian government entities, with SVG attachments redirecting victims to a download site, and researchers also link a Vietnamese-speaking threat group to a separate flow that culminates in PureRAT after dropping PXA Stealer.

Fortinet’s Yurren Wan described the SVG as an HTML substitute to initiate infection, and Huntress’ James Northey described the campaign as showing a progression from simple phishing to in‑memory loaders and credential theft.