PureLog Stealer

ATTACK TECHNIQUES Social Engineering and Phishing collectively account for 13 of 38 technique-attributed incidents, making human manipulation the most prevalent attack category across the period.

The notification impersonated a security warning from GitHub and included a link to a fake GitHub website.

Once opened, the file runs through Windows Script Host and immediately launches PowerShell with security checks turned off. From there, PowerShell reaches out to attacker-controlled Blogspot pages to fetch the next stages, without saving a suspicious file to disk. | PowerShell then uses a download cradle, fetching code directly from a Blogspot page and running it from memory. Nothing is written to the hard drive at this stage, so many file scanning tools never inspect it.

Once the victim executes the malicious lure, a command interpreter launches silently in the background.

The extracted content includes a renamed Python interpreter called svchost.exe and a heavily obfuscated Python script named instructions.pdf.

However, this actually ran JavaScript that downloaded a ZIP file from a Dropbox URL. Then, copyToClipboard was executed which invoked PowerShell to unzip and launch the BAT file embedded in the ZIP.

Once a victim double clicks transcript.pdf.js, Windows Script Host quietly hands control to PowerShell, forcing a connection with execution policy checks bypassed entirely.

It then establishes registry persistence under HKCU\Run\SystemSettings , ensuring the malware restarts automatically on every user login.

It then establishes registry persistence under HKCU\Run\SystemSettings , ensuring the malware restarts automatically on every user login.

niple.docx.odp.pdf.sys, carries two large blocks of encoded numeric data. These decode into working dot NET programs

A file named transcript.pdf.js looks like an ordinary PDF at first glance, but Windows treats it very differently behind the scenes. Since Windows often hides file extensions by default, victims see only transcript.pdf and have little reason to suspect anything is wrong.

This sets up the final deployment of the PureLog payload, which is executed directly in memory — again, leaving scarcely an artifact trail.

The retrieved file, named phud.dudus.docx.pdf.olp.sys, deletes the original JavaScript launcher to erase evidence

It also decrypts a hidden payload using a repeating XOR key.

If that approach fails, the malware falls back on trusted Microsoft signed tools such as InstallUtil, MSBuild, RegSvcs, and the C sharp compiler, blending in with activity that security software usually ignores.

the first one, which is Python-based, initiating the infection chain with an environmental check for sandbox or virtual machine detection.

These decode into working dot NET programs, loaded directly into memory using reflection, meaning no executable ever touches the disk.

Incident volume peaked in the middle period (25 events, March 10 to April 10), driven by the USD 280 million Drift heist and a surge in phishing and credential-theft campaigns targeting US-based financial institutions.

PureLog Stealer harvests whatever valuable data it can find, including saved browser passwords, cookies, autofill entries, browsing history, and cryptocurrency wallet details.

PureLog Stealer harvests whatever valuable data it can find, including saved browser passwords, cookies, autofill entries, browsing history, and cryptocurrency wallet details.

successful compromise of a targeted system can result in credential theft, account takeover, and downstream intrusion activity

The script also takes a full-screen screenshot, collects the machine hostname, username, and installed antivirus product names...

The stealer also gathers information about the infected system, giving attackers a clearer picture of what they compromised.

the first one, which is Python-based, initiating the infection chain with an environmental check for sandbox or virtual machine detection.

The script also takes a full-screen screenshot... then sends all of it to the command-and-control server via an HTTPS POST request.

Opening the attachment or clicking on the link leads to a compressed archive containing what looks like a benign document, typically a PDF file, as well as supporting files required for execution.

PowerShell commands, Blogspot visits, and trusted Microsoft utilities are things security teams see every day, which is why this approach slips past antivirus tools so easily.

PowerShell reaches out to attacker-controlled Blogspot pages to fetch the next stages, without saving a suspicious file to disk.

...then sends all of it to the command-and-control server via an HTTPS POST request.

features a series of evasive maneuvers — including a bypass for Windows Defender's Antimalware Scan Interface (AMSI)

The script first bypasses Windows Defender’s Antimalware Scan Interface by patching memory directly, preventing the system from scanning what follows.