A Vietnamese threat actor has transitioned from using the PXA Stealer to deploying PureRAT, a commercial remote access trojan. The attack chain involves multiple stages, including phishing emails, Python-based infostealers, and .NET loaders. The campaign demonstrates a progression in complexity, utilizing DLL sideloading, obfuscation techniques, and defense evasion methods. The final payload, PureRAT, provides the attacker with extensive control over compromised systems. The threat actor's shift to commodity malware indicates a maturing operation, lowering the barrier for sophisticated attacks. This evolution highlights the need for robust, multi-layered defense strategies to counter such adaptable threats.