Copyright Lures and “Fileless” Shadows: Inside the PureLog Stealer Campaign

Trend Micro uncovered a sophisticated, targeted campaign distributing the PureLog Stealer via localized phishing 'legal notice' lures aimed at healthcare, government, and education organizations in Germany, Canada, and the U.S.; the attack uses remotely encrypted payloads (extracted by a renamed WinRAR), a Python loader that patches AMSI to enable fileless, in-memory execution, redundant .NET loaders for resilience, registry persistence, victim fingerprinting, screenshot capture, and HTTPS exfiltration of harvested credentials and system data.