Since July 2024, a phishing campaign in Poland and Germany has used PureCrypter to deploy TorNet via TOR, evading cloud antimalware with advanced anti.