A malware campaign attributed to PureRAT targets job seekers via email lures using archived “HR documents” that drop a Foxit Reader–branded executable for DLL side-loading, then runs batch/Python staging (including base64-downloaded loader), sets persistence via an autorun registry entry, and steals browser data while communicating with attacker infrastructure.