Copyright Lures Mask a Multi-Stage PureLog Stealer Attack on Key Industries
Essential information
- Published
- 20/03/2026 09:13
- Modified
- 20/03/2026 08:46
- Source / Author
- AlienVault
- Confidence
- 100/100
- Report type(s)
- threat-report
- Labels / Tags
- copyright lure evasion techniques fileless execution information theft multi-stage attack purelog stealer targeted campaign
- Tags
- 2026-03-20 copyright lure evasion techniques fileless execution information theft multi-stage attack purelog stealer targeted campaign
- Related entities
- 18 indicators, 18 observables, 18 techniques (mitre), 1 malware, 15 others
Description
A sophisticated malware campaign delivering PureLog Stealer has been identified, targeting healthcare, government, hospitality, and education sectors in multiple countries. The attack uses localized copyright violation lures to trick victims into executing a multi-stage infection chain. The malware employs encrypted payloads, remote key retrieval, and fileless execution techniques to evade detection. It utilizes a Python-based loader and dual .NET loaders to run PureLog Stealer entirely in memory. The campaign incorporates AMSI bypass, registry persistence, screenshot capture, and victim fingerprinting for stealth and intelligence gathering. Evidence confirms communication with PureLog-associated infrastructure.