PureLog Stealer Campaign Uses Copyright Lures and Fileless, Multi-Stage Delivery

Mar 19, 2026 · Original article ↗

Summary

Trend Micro details a targeted PureLog Stealer campaign using localized copyright-violation lures, encrypted staged payloads, and Python and .NET loaders to evade detection and steal sensitive data.

Key points

The campaign uses language-matched copyright-violation notices, likely delivered through phishing links and, in some cases, Google Ads malvertising.
Its delivery chain disguises an encrypted archive as a PDF, retrieves the decryption key remotely, and uses a renamed WinRAR utility to extract payloads.
A Python-based loader bypasses AMSI, establishes registry persistence, fingerprints victims, captures screenshots, and executes encrypted .NET assemblies in memory.
Two obfuscated .NET loaders run concurrently as a fallback mechanism and deliver PureLog Stealer without writing the final payload to disk.
The stealer targets browser credentials, extensions, cryptocurrency wallets, and system information, and communicates with PureLog-associated infrastructure.
Observed targets span healthcare, government, hospitality, and education organizations in Germany, Canada, the United States, and Australia.

Article Details

Attack Vectors: A user manually executes an executable disguised as a localized copyright-violation notice; the article reports no exploit or vulnerability at this stage.
The campaign likely uses phishing emails with malicious download links and was also reported to use Google Ads malvertising.
The infection chain downloads an encrypted payload disguised as a PDF, retrieves its password from a separate endpoint, and extracts it using a renamed WinRAR executable.
A Python-based loader and two .NET loaders execute PureLog Stealer in memory; the article also reports DLL sideloading and an observed process-injection attempt.
Defensive Notes: Avoid clicking links in unsolicited or unexpected emails.
The TrendAI Vision One detection model described in the article identifies direct executable downloads from URLs containing Google Ads tracking parameters, subject to a domain whitelist.
The article recommends behavioral detection, network telemetry, and proactive threat hunting to identify the campaign.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`dq[.]bestshoppingday[.]com`	Domain observed in DNS telemetry during investigation of the campaign.
DOMAIN	`logs[.]bestsaleshoppingday[.]com`	Domain identified among infrastructure previously observed in the investigated incident.
DOMAIN	`logs[.]bestshopingday[.]com`	Domain described by the article as strongly associated with PureLog Stealer.
DOMAIN	`mh[.]bestshopingday[.]com`	Domain identified among infrastructure previously observed in the investigated incident.
DOMAIN	`quickdocshare[.]com`	Payload-delivery and password-retrieval infrastructure used by the campaign.
IPV4	`166[.]0[.]184[.]127`	Identified as a PureLog Stealer C&C server.
SHA1	`f4532fc1e5d53a732fcc883f7125ceb06b985048`	SHA-1 hash of svchost.exe, identified as a renamed Python application extracted by the campaign.
SHA256	`1539dab6099d860add8330bf2a008a4b6dc05c71f7b4439aebf431e034e5b6ff`	SHA-256 hash of the malicious lure executable, also identified as renamed ADNotificationManager.exe.
SHA256	`35efc4b75a1d70c38513b4dfe549da417aaa476bf7e9ebd00265aaa8c7295870`	SHA-256 hash of the malicious lure ZIP archive.
SHA256	`ac591adea9a2305f9be6ae430996afd9b7432116f381b638014a0886a99c6287`	SHA-256 hash of the urlmon.dll shellcode loader.
URL	`hxxps[:]//cdn[.]eideasrl[.]it/Notice%20of%20Alleged%20Violation%20of%20Intellectual%20Property%20Rights_1770380091603[.]zip`	Specific URL identified as distributing the malicious lure archive.
URL	`hxxps[:]//quickdocshare[.]com/DQ`	Attacker-used URL from which the encrypted payload was downloaded.
URL	`hxxps[:]//quickdocshare[.]com/DQ/key`	Attacker-used endpoint that supplied the payload decryption password; shown in the article in this form.