Copyright-Themed Lures Deliver Multi-Stage PureLog Stealer in New Credential Theft Campaign

A targeted phishing campaign uses fake copyright violation notices and language-specific lures to trick victims into downloading and executing a malicious executable that ultimately deploys PureLog Stealer; the multi-stage attack employs encrypted payloads with runtime decryption, a renamed Python interpreter and WinRAR, AMSI patching to evade scans, registry persistence (HKCU\Run\SystemSettings), and in-memory .NET loaders to exfiltrate browser credentials, crypto wallet data, and system information from organizations in healthcare, government, education, and hospitality across multiple countries.