New PureLog Stealer Campaign Uses Copyright Lures to Steal Credentials

Key Takeaways

• A new campaign leveraging the PureLog Stealer malware is actively targeting organizations across healthcare, government, education, and hospitality sectors.
• Attackers employ sophisticated social engineering tactics, using fake copyright infringement notices and localized phishing emails to trick victims into executing malicious files.
• PureLog Stealer is a potent infostealer designed to harvest sensitive data, including browser credentials, cryptocurrency wallet information, and system details.
• The campaign utilizes a multi-stage infection chain with advanced evasion techniques, such as encrypted payloads, remote decryption, in-memory execution, and AMSI bypass, making detection difficult for traditional antivirus solutions.

PureLog Stealer Campaign Targets Multiple Sectors with Copyright Lures

A sophisticated new cyberattack campaign, first identified in March 2026, is deploying the dangerous PureLog Stealer malware against critical sectors including healthcare, government, education, and hospitality. This operation relies on meticulously crafted social engineering, luring victims with deceptive copyright infringement notifications to initiate a complex, multi-stage infection process that ultimately leads to the exfiltration of sensitive data.

PureLog Stealer is a notorious information-stealing malware capable of extracting a wide array of personal and corporate data. Its capabilities include harvesting browser credentials, cryptocurrency wallet data, browser extension information, and general system details. The malware is recognized for its accessibility and ease of use, making it an attractive tool for a broad spectrum of threat actors, including those with limited technical expertise.

The campaign’s delivery mechanism primarily involves phishing emails containing malicious download links, rather than direct attachments. These lures are tailored by language, with German-language versions targeting Germany and English-language variants aimed at Canada and other regions, indicating a deliberate and geographically segmented approach.

Social Engineering as a Primary Vector

Researchers at Trend Micro have confirmed that this campaign does not exploit software vulnerabilities. Instead, its success hinges entirely on social engineering, manipulating users into manually executing a file disguised as a legitimate legal document. The malicious executables often bear convincing names, such as “Documentation on Intellectual Property Rights Violations.exe,” designed to appear authentic to unsuspecting recipients.

This reliance on human interaction makes the campaign particularly challenging to defend against, as conventional patch management strategies are ineffective. The targeted industries—healthcare, government, hospitality, and education—are frequently accustomed to receiving legal and compliance-related communications, making the copyright lure highly credible within these environments.

Geographically, the campaign has shown significant activity in Germany and Canada, with additional reported victims in the United States and Australia. The localized language targeting and specific industry focus suggest a highly organized operation, rather than a scattershot mass-spamming effort.

Advanced Evasion Techniques Employed

A defining characteristic of this threat is the high level of technical sophistication embedded within its infection chain. The malware employs encrypted payloads, retrieves decryption keys remotely, and executes almost entirely in memory. This “fileless” approach leaves minimal forensic evidence on compromised systems, significantly hindering analysis and detection by endpoint security solutions that primarily rely on file creation monitoring.

Inside the Multi-Stage Infection Chain

The infection begins when a victim executes the initial malicious lure. A command interpreter silently launches in the background, while a seemingly harmless decoy PDF document immediately opens on screen to distract the user.

Concurrently, the malware communicates with attacker-controlled infrastructure to download an encrypted archive, cleverly disguised as a PDF file named invoice.pdf.

Crucially, the decryption password for this archive is not embedded within the malware itself. Instead, it is retrieved dynamically from a separate server endpoint during runtime. This design choice complicates offline analysis and grants the attackers granular control, allowing them to remotely manage or even terminate individual infection attempts.

Following this, a renamed WinRAR executable, camouflaged as a PNG image file, utilizes the retrieved password to extract the actual payload.

The extracted contents include a renamed Python interpreter, posing as svchost.exe, and a heavily obfuscated Python script named instructions.pdf. This script first bypasses Windows Defender’s Antimalware Scan Interface (AMSI) by directly patching memory, effectively preventing subsequent malicious activities from being scanned.

To maintain persistence, the script establishes a registry entry under HKCURunSystemSettings, ensuring that the malware automatically reactivates with every user login. It then proceeds to capture a full-screen screenshot, gather the machine’s hostname, current username, and a list of installed antivirus products, transmitting all this reconnaissance data to the command-and-control server via an HTTPS POST request.

In the final stage, two identical .NET loader files decrypt and inject the PureLog Stealer directly into memory. This “fileless” execution ensures that no persistent files are written to disk, further complicating detection by traditional signature-based antivirus solutions.

What You Should Do

• Employee Training: Educate employees to be highly suspicious of unexpected emails concerning copyright violations, especially those containing download links. Emphasize verification of sender identity through official channels before clicking any links or downloading files.
• Registry Monitoring: Implement robust monitoring for unusual entries in registry Run keys, which malware often uses for persistence.
• Process Monitoring: Monitor for Python or WinRAR processes initiating from non-standard directory paths, as this can indicate malicious activity.
• Network Filtering: Block outbound connections to known malicious domains and IP addresses associated with command-and-control infrastructure.
• Advanced Detection Tools: Deploy behavioral detection tools and leverage network telemetry to identify anomalous activity that signature-based antivirus might miss due to the campaign’s fileless execution methods.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.