PurpleFox

PurpleFox is a modular Windows malware family active since at least 2018 that combines exploit-driven propagation, rootkit-enabled stealth, backdoor functionality, downloader behavior, and botnet operations. It has also been closely associated with delivery of DirtyMoe, and some reporting has used the two names interchangeably, though PurpleFox is widely recognized as its own malware family and exploit ecosystem.

PurpleFox commonly infects systems through malicious MSI installers, exploit-kit activity, and other staged delivery chains. Observed distribution methods include drive-by exploitation through the PurpleFox exploit kit, abuse of WPAD for zero-click delivery, PowerShell-based download chains, fake software or trojanized installers, and MSHTA-assisted execution chains. It has incorporated multiple Windows and Internet Explorer vulnerabilities over time, including browser exploitation for initial compromise and local privilege-escalation exploits to obtain elevated execution before installing its components.

A defining feature of PurpleFox is its rootkit-backed persistence and defense evasion. Its installation workflow has been observed modifying system configuration and scheduling replacement of legitimate service-related DLLs so that malicious code executes with SYSTEM privileges after reboot. PurpleFox deploys additional DLLs and a kernel-mode rootkit component that can hide malware files, registry keys, processes, and related artifacts, making eradication difficult and enabling long dwell times on compromised hosts.

PurpleFox supports downloader and backdoor roles. It can retrieve and install second-stage payloads, maintain command-and-control communications, fingerprint infected hosts, execute commands, enumerate files and directories, create or terminate processes, perform WMI and DNS queries, and exfiltrate data. Newer variants have used WebSocket-based command and control with encrypted session establishment, reflecting continued development and operational maturity.

PurpleFox has also demonstrated self-propagation and botnet behavior. Reported campaigns indicate it can spread by exploiting known vulnerabilities and by brute-forcing passwords, and it has been described as capable of distributed denial-of-service activity. In incident investigations, PurpleFox infections have also co-occurred with cryptocurrency mining payloads such as XMRig, indicating use for monetization beyond simple access operations.

Geographically, PurpleFox infrastructure and victimology have been observed across multiple regions, including Ukraine, the Middle East, and parts of Asia, with repeated reporting of substantial infrastructure presence in China. PurpleFox remains active into 2026 and continues to evolve its delivery chains, privilege-escalation arsenal, and stealth mechanisms.