Copyright Lures Mask a Multi‑Stage PureLog Stealer Attack on Key Industries

This report analyzes a targeted, multi-stage PureLog Stealer campaign that uses localized copyright‑lure executables and phishing/malvertising to deliver an encrypted payload masquerading as a PDF; attackers retrieve per-victim decryption keys remotely, use a renamed WinRAR for extraction, a Python loader (with AMSI bypass and in-memory .NET payload loading), and dual .NET loaders to execute the infostealer entirely in memory. Observed victims are primarily in healthcare and government across Germany, Canada, the US, and Australia, with active C2 infrastructure and multiple IOCs provided for detection and hunting.