Phishing With a Driver's License: PureLogs, Loader Swaps, and the Hunt for Hidden Windows Evasion

What makes this campaign notable is not just the malware name, but the way the delivery chain was rebuilt to dodge common detection points. Japanese- and Korean-language emails used a damaged-product complaint as bait, then pushed victims toward ZIP-based loaders that changed between samples while still leading to the same payload families. That matters because defenders who rely too heavily on file hashes can lose sight of a campaign even when the underlying behavior stays familiar.

Fast Facts

• Japanese- and Korean-language phishing emails used a damaged-product complaint lure.
• The campaign delivered PureLogs and PureRAT through changing loaders.
• Researchers observed the activity during July and August 2026.
• The chain included BYOVD, AMSI bypass, and process hollowing.
• No named victim organization or confirmed theft outcome was identified in the available material.

Why the loader swap matters

The most defensive part of the story is the loader churn. If the payload family stays similar but the initial loader changes, a static hash blocklist can quickly become stale. In practice, that means one sample may be caught while the next wave slips through under a new filename, new archive, or slightly altered wrapper. The technique does not need to be exotic to be effective - it just needs to frustrate deterministic matching.

Microsoft’s public description of PureLogs places it in the infostealer category, which makes credential theft, browser data access, and post-compromise follow-on risk the key concerns. PureRAT adds another layer of uncertainty, because the campaign was not built around a single disposable payload. Even so, the available material only confirms delivery of both families; it does not establish the operators’ full intent for each branch.

Where the evasion gets sharper

BYOVD, or Bring Your Own Vulnerable Driver, is especially important because it can shift abuse into kernel-adjacent territory. MITRE describes it as exploiting a signed but vulnerable driver to gain deeper control. That does not automatically mean every protection is bypassed, but it can raise the cost of defense by moving the fight closer to the operating system’s trust boundary.

AMSI is another pressure point. Windows applications and script hosts can hand content to an antimalware engine for inspection, so a successful AMSI bypass can reduce what defenders see in script-heavy execution chains. Process hollowing then adds concealment by running malicious code inside a legitimate-looking process. Taken together, these techniques suggest a campaign aimed at reducing both static and runtime visibility, not just disguising one file.

At the time of writing, the public record supports a risk analysis, not a claim of confirmed theft, broad downstream compromise, or a fully established operational scope.

Defensive takeaway

The lesson is straightforward: campaigns like this punish single-control thinking. Email filtering matters, but so do script telemetry, driver-load monitoring, process-tree analysis, and memory-aware detection. If an operator can rotate loaders while mixing social engineering with Windows evasion tricks, defenders need to correlate signals across the chain instead of waiting for one bad hash to reveal the whole picture. In other words, the real target is not just the endpoint, but the assumptions behind how that endpoint is monitored.

Conclusion

PureLogs here is less a standalone name than a reminder that modern malware often arrives as a moving stack of deception, not a fixed artifact. The broader lesson is that resilient detection must watch behavior, trust boundaries, and execution paths together, or risk missing the attack entirely when the wrapper changes but the threat does not.

WIKICROOK

• BYOVD: A technique that abuses a signed but vulnerable driver to gain stronger system access and interfere with defenses.
• AMSI: The Windows Antimalware Scan Interface, which lets security tools inspect content before or during execution.
• Process hollowing: A method that replaces the memory of a legitimate process with malicious code to hide execution.
• Loader: A staging component that delivers or launches the main payload and can be changed to evade detection.
• Hash-based detection: A security method that matches known file hashes, which breaks down when attackers alter samples.