How Attackers Use JavaScript and PowerShell to Steal Your Credentials

The PureLogs infostealer campaign is a textbook example of a technique that is spreading fast: use normal Windows tools to silently steal everything on your machine. Here is how it works, why it is so hard to stop, and what defenders can do.

When most people think about malware, they imagine a suspicious file downloaded from a shady website. The reality in 2026 looks very different. Today’s most effective attacks start with an ordinary-looking email, use tools that are already installed on your computer, and never write the most dangerous parts of the attack to your hard drive at all. The recent PureLogs campaign analyzed by FortiGuard Labs is one of the clearest examples of this approach, and understanding it helps explain a broader pattern that appears across dozens of criminal operations.

The short version: a fake invoice email delivers a compressed archive. Inside is a JavaScript file. That file quietly starts a PowerShell session, loads a malicious program entirely in memory, hides it inside a legitimate Windows process, and proceeds to steal every credential, session token, browser cookie, cryptocurrency wallet file, and password it can find. Nothing obviously suspicious ever appears on screen.

Why Attackers Use JavaScript as the Opening Move

JavaScript is not just a web browser language. Windows ships with a built-in component called the Windows Script Host that can run JavaScript files directly from the desktop, from inside archives, or when double-clicked from an email attachment. Attackers exploit this because it requires no installation, no admin rights, and no special software. The victim just has to open the file.

MITRE ATT&CK classifies this as T1059.007, Command and Scripting Interpreter: JavaScript, noting that attackers abuse JavaScript for execution both inside and outside browsers. In the PureLogs campaign, the JavaScript file inside the archive did not immediately do anything visible. Instead it decrypted a set of PowerShell commands, stored them in hidden environment variables on the machine, and then quietly launched PowerShell to run them. To confuse security analysts, the script was padded with garbled text and fake comments written in Chinese, Japanese, and Russian, making it look like incomprehensible noise.

The user believed they were opening a purchase order confirmation. The script was quietly preparing the next stage of a credential-theft operation.

This use of JavaScript as a bridge between the social engineering trick and the actual malware is a deliberate design choice. The JavaScript stage itself does not steal anything. It just unlocks the door. That separation makes it easier to swap out components and harder for security tools to attribute the activity to a specific malware family.

Why PowerShell Is the Weapon of Choice for the Next Stage

PowerShell is a powerful command-line tool built into every modern version of Windows. System administrators use it every day for legitimate work. That legitimacy is exactly why attackers love it. When PowerShell runs, most systems assume it is doing something authorized. MITRE tracks this behavior as T1059.001, Command and Scripting Interpreter: PowerShell.

In the PureLogs campaign, PowerShell was launched with a set of arguments specifically chosen to reduce visibility. It ran with a hidden window so nothing appeared on screen, it bypassed execution policy restrictions to avoid prompts, and it avoided loading the user’s profile to leave fewer traces. The script it ran was encoded in Base64 and then additionally encrypted with XOR, meaning that even if someone captured the command line, they would see what looked like random gibberish. Once decoded and decrypted, the PowerShell session loaded the next-stage malware entirely in memory, a technique called fileless execution that bypasses antivirus tools that look for suspicious files on disk.

Hiding Inside a Trusted Windows Process

Once the PowerShell stage completes its work, the PureLogs attack takes one more step to evade detection. It uses a technique called process hollowing, where the malicious code is injected into a legitimate, trusted Windows application so that from the outside it looks like that program is running normally. MITRE classifies this as T1055.012.

In the PureLogs campaign analyzed by FortiGuard Labs, the chosen host process was MsBuild.exe, a genuine Microsoft developer tool used to compile software projects. Using a trusted developer tool to run malicious code has its own MITRE classification: T1127.001, Trusted Developer Utilities Proxy Execution. Because MsBuild.exe is signed by Microsoft, many security tools and analysts initially treat it as trustworthy. The malicious activity happening inside it has to be detected through behavioral signals rather than simple reputation checks, which is a much harder problem.

What PureLogs Actually Steals

PureLogs is not just a delivery mechanism. It is a fully featured information stealer sold on a subscription basis for around $150 per month on criminal markets. Once active, the fileless module works through the machine systematically, collecting everything that could be valuable to an attacker or resold on criminal marketplaces.

The theft of session cookies and Discord tokens deserves special attention. A session cookie lets someone use a web application as if they were already logged in, without needing the password. Many services do not invalidate existing sessions when a password is changed. That means stolen session material can give attackers persistent access to email accounts, cloud storage, developer tools, and business applications even after the victim realizes something is wrong and changes their credentials. MITRE classifies this browser credential theft as T1555.003 and the clipboard monitoring as T1115.

After collecting everything, PureLogs encrypts the data using AES before sending it to a remote command-and-control server over HTTPS, making the outbound traffic look like ordinary encrypted web browsing. Without deep packet inspection tuned for anomalous patterns, this exfiltration step is difficult to detect at the network level.

Real-World Examples: The Same Pattern in Other Major Campaigns

PureLogs is not an isolated case. The combination of JavaScript, PowerShell, fileless execution, and process injection appears across a wide range of criminal malware families. The following cases all use recognizably similar logic.

What Defenders Should Watch For

The PureLogs campaign and others like it are effective because every individual step looks plausible in isolation. JavaScript files are opened by users constantly. PowerShell running on a Windows machine is completely normal. HTTPS traffic to a server is ordinary web activity. MsBuild.exe is a trusted Microsoft tool. Detection requires watching for combinations of behaviors rather than single events.

Conclusion: This Is the New Normal

JavaScript and PowerShell are not dangerous because they are inherently malicious tools. They are dangerous because attackers have become very skilled at combining them with obfuscation, trusted Windows processes, in-memory execution, and credential theft modules into a single operational chain that bypasses most of the defenses organizations have traditionally relied on.

PureLogs sells for $150 a month on criminal forums and is available to anyone willing to pay. That price point means it is not just sophisticated nation-state actors using this operational model. It is criminal operators with no specialized technical skills, following a playbook that does the hard work for them. SocGholish, QakBot, Emotet, and PureLogs all demonstrate that the same basic architecture, a script to launch PowerShell, PowerShell to load malware in memory, malware to steal credentials, has become the standard template for Windows-based criminal operations.

References

Primary research and threat reports

MITRE ATT&CK technique references

This article is provided for informational and educational purposes. All referenced research is publicly available from the cited sources. Organizations should consult qualified cybersecurity professionals for incident response guidance.