WINDOWS MALWARE USES PULSAR RAT FOR LIVE CHATS WHILE STEALING DATA

Summary from the TLDR InfoSec newsletter

A newly discovered Windows malware campaign combines the Pulsar RAT with Stealerv37, using Donut loader shellcode injection into explorer.exe to operate entirely in memory while evading traditional antivirus detection. The attack chain begins with an obfuscated batch file in %APPDATA%\Microsoft that leverages PowerShell for fileless execution, deploying capabilities including webcam/microphone surveillance, clipboard hijacking for crypto wallet address swapping, and credential theft from browsers, VPNs, and gaming platforms. Notably, attackers actively engage victims via a live chat window while simultaneously exfiltrating stolen data via Discord and Telegram, maintaining persistence through a watchdog mechanism and defensive evasion via Task Manager and UAC disabling.