Copyright Lures Mask a Multi-Stage PureLog Stealer Attack on Key Industries
A sophisticated malware campaign delivering PureLog Stealer has been identified, targeting healthcare, government, hospitality, and education sectors in multiple countries. The attack uses localized copyright violation lures to trick victims into executing a multi-stage infection chain. The malware employs encrypted payloads, remote key retrieval, and fileless execution techniques to evade detection. It utilizes a Python-based loader and dual .NET loaders to run PureLog Stealer entirely in memory. The campaign incorporates AMSI bypass, registry persistence, screenshot capture, and victim fingerprinting for stealth and intelligence gathering. Evidence confirms communication with PureLog-associated infrastructure.
Pulse ID: 69bd01b20154ae405e9187fe
Pulse Link: https://otx.alienvault.com/pulse/69bd01b20154ae405e9187fe
Pulse Author: AlienVault
Created: 2026-03-20 08:13:38
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#CyberSecurity #Education #Government #Healthcare #Hospital #InfoSec #Malware #NET #OTX #OpenThreatExchange #Python #RAT #bot #AlienVault