BEIJING – Security researchers at 360 Netlab have issued an urgent warning about the growing activity of PureCrypter, a malware loader that has become a central piece of the cybercrime ecosystem under the Malware-as-a-Service (MaaS) model.
Unlike other viruses that have a specific target, PureCrypter acts as an elite messaging service for other criminal groups, specializing in "promoting" and installing diverse malware families onto infected machines in exchange for payment.
A Logistics Hub for MalwareAccording to Netlab's latest report, PureCrypter is not a newcomer—it has been active since at least March 2021—but its volume of operations reached critical levels in 2026. Analysts have detected that this loader is actively distributing more than 10 different malware families, transforming a single initial infection into a multifaceted nightmare for victims.
Among the "goods" PureCrypter is currently delivering are:
Spyware and Data Stealers: AgentTesla, SnakeKeylogger, and Formbook.
Remote Access Trojans (RATs): AsyncRAT and Remcos.
Info-stealers: Redline, capable of emptying crypto wallets and browser credentials in seconds.
What makes PureCrypter especially dangerous for organizations is its sophisticated evasion technique. The malware is written in C# and uses a complex system of "layers" to hide from traditional antivirus solutions.