Hackers Use Compromised Websites and transcript.pdf.js Lure to Deliver PureLog Stealer

Attackers distribute a PureLog Stealer campaign using deceptive transcript.pdf.js files that launch small JavaScript stages via Windows Script Host to spawn PowerShell with execution-policy bypasses; PowerShell pulls additional, XOR-obfuscated stages from attacker-controlled Blogspot pages, decodes and reflectively loads .NET assemblies in memory, and uses LOLBINs and cleanup/delay techniques to evade detection. The stealer harvests browser credentials, cookies, autofill data, browsing history, and multiple cryptocurrency wallets, and defenders are advised to monitor PowerShell script block logging, process lineage, memory-resident .NET execution, and suspicious Invoke-RestMethod/Invoke-Expression activity.