PureLogs Stealer PowerShell C2 TLS Connection to vm180012.hosted-by.qwins.co

Duo Tech@duotech

•updated Aug 20, 2026•0•0•4

Detects network activity (DNS queries and TLS connections) to the known command-and-control (C2) domain 'vm180012.hosted-by.qwins.co' associated with the PureLogs Stealer malware.