PureRAT (Malware): news timeline & CVEs

Hackers Use Negative Hotel Reviews to Spread Malware That Hides C2 on Blockchain

Cofense says hotel staff are phished with fake complaints that deliver EtherRAT and TONResolver using blockchain C2.

Cofense reported that attackers email hotel front-desk and guest-relations staff with fake negative reviews and complaint links that lead to malware. Archives contain a Windows LNK shortcut disguised as a photo; opening it downloads Node.js and installs EtherRAT or TONResolver. EtherRAT reads an Ethereum smart contract over a public JSON-RPC service to recover its command-and-control address, while TONResolver uses a TON blockchain API, a method known as dead-drop resolving. Cofense assesses with moderate confidence that the activity continues earlier Booking.com phishing that delivered PureRAT or NetSupport Manager, and that generative AI may vary the email wording.

Cyber Security News14:44 UTC · 7h agoMalware in the wild 2 sources

Attackers Are Turning Everyday Business Emails Into Malware Delivery Machines

A 2026 email campaign used damage and refund lures to deliver PureRAT and PureLogs via fake download sites.

ITOCHU Cyber & Intelligence reported a July–August 2026 campaign that emailed Japanese and Korean organizations about damaged goods, shipping problems, and refunds. Links led to multilingual fake document-sharing or video sites that offered ZIP archives hiding executables, including double-extension files and a malicious DLL loaded by a Microsoft-signed program. Loaders varied, including bundled Python, a modified Donut loader, and in-memory execution, with persistence through startup shortcuts, scheduled tasks, or the registry. Payloads were PureRAT, a remote access tool, and PureLogs, an infostealer collecting browser data, Discord information, screenshots, and files; one variant used a signed vulnerable driver to kill security processes.

Cyber Security NewsSep 25, 12:01 UTC · 13d agoMalware in the wild

PureRAT

Timeline2 articles

Appears with

Hackers Use Negative Hotel Reviews to Spread Malware That Hides C2 on Blockchain

Attackers Are Turning Everyday Business Emails Into Malware Delivery Machines