Copyright Complaint Lures Linked to New PureLog Stealer Credential Theft Wave

This report documents an active, targeted campaign distributing the PureLog Stealer via localized phishing and Google Ads malvertising to organizations in healthcare, government, hospitality, and education across Germany, Canada, the United States, and Australia; it describes a multi-stage chain (decoy PDFs, remote key retrieval, fileless Python loader that patches AMSI, ConfuserEx .NET loaders, and in-memory reflective execution) and includes multiple IOCs (SHA‑256 hashes, domains, and IP addresses) for detection and response.