Executive Summary
This campaign delivers PureLog Stealer through highly targeted, language-matched phishing lures disguised as legal copyright violation notices. The attack infrastructure is notably evasive, employing a multi-stage delivery chain that utilizes encrypted payloads, remote key retrieval from attacker-controlled servers, and fileless execution via Python and .NET loaders. By retrieving decryption keys dynamically, the threat actors prevent offline analysis and maintain control over payload activation.
The malware exhibits advanced stealth capabilities, including patching the Antimalware Scan Interface (AMSI) in memory to bypass Windows Defender and utilizing a renamed Python interpreter (svchost.exe) to execute obfuscated scripts. Telemetry indicates active targeting of healthcare, government, hospitality, and education sectors across North America, Europe, and Australia. The use of in-memory execution and redundant .NET loaders (Dgrfauysx.exe and Fsywsuac.exe) demonstrates a high level of operational maturity designed to defeat traditional disk-based security controls.