Copyright Lures Mask a Multi-Stage PureLog Stealer Attack on Key Industries

A sophisticated malware campaign delivering PureLog Stealer has been identified, targeting healthcare, government, hospitality, and education sectors in multiple countries. The attack uses localized copyright violation lures to trick victims into executing a multi-stage infection chain. The malware employs encrypted payloads, remote key retrieval, and fileless execution techniques to evade detection. It utilizes a Python-based loader and dual .NET loaders to run PureLog Stealer entirely in memory. The campaign incorporates AMSI bypass, registry persistence, screenshot capture, and victim fingerprinting for stealth and intelligence gathering. Evidence confirms communication with PureLog-associated infrastructure.

• SEO Poisoning Campaign Targets DeepSeek Users: Chinese Threat Actor Deploys Kong RAT via Multi-Stage AttacksMalware2026-10-29
• 2CLoader: A New Malware Loader Delivering Vidar and RemusMalware2026-09-30
• OpenSUpdater Hides in Recompiled 7zip SFX, Evading AnalystsMalware2026-09-24
• A fake resume invoked China's defence-tech elite, then installed VShellMalware2026-08-28
• ClickFix Keeps Evolving: Rundll32 Ordinal Execution over WebDAVCampaign2026-07-29