Hackers Use Compromised Websites and transcript.pdf.js Lure to Deliver PureLog Stealer

Hackers are using compromised websites and a deceptive transcript.pdf.js lure to deliver PureLog Stealer through a layered, fileless infection chain that leans heavily on PowerShell, trusted cloud infrastructure, and in-memory execution.

The campaign, described in the attached research, shows how modern stealers increasingly rely on social engineering and living-off-the-land techniques rather than noisy malware binaries.

The initial access vector is a malicious JavaScript file masquerading as a document, such as transcript.pdf.js , which is designed to exploit hidden file extensions and user trust in familiar file names.

When opened, Windows Script Host launches the script, which then spawns PowerShell with execution policy bypasses enabled. That first-stage script is intentionally small and disposable, acting mainly as a launcher for the payload rather than containing the full malware itself.

From there, PowerShell retrieves additional stages from attacker-controlled Blogspot pages, abusing Google-owned infrastructure to make malicious traffic look more legitimate and to reduce the value of simple domain reputation filters.

The threat actors also use decoy content, cleanup routines, and short execution delays to make analysis harder and to reduce visible artifacts on the victim system.

What makes this campaign technically notable is the breadth of its defense-evasion stack. The loader uses XOR-obfuscated payloads, runtime decoding, dynamic URL generation, and reflective .NET assembly loading so that code is reconstructed and executed in memory instead of being written to disk.

Securonix said in a report shared with GBhackers , the campaign, described in the attached research, shows how modern stealers increasingly rely on social engineering and living-off-the-land techniques rather than noisy malware binaries.

That fileless design limits forensic evidence and weakens traditional antivirus products that depend on file hashes, static signatures, or on-disk samples.

The attackers also fall back to trusted Microsoft binaries such as regsvcs.exe , InstallUtil.exe , msbuild.exe , csc.exe , vbc.exe , ilasm.exe , and aspnetcompiler.exe when needed.

Those LOLBIN-style execution paths matter because they let malicious activity blend into normal administrative or developer workflows, which can easily delay detection in enterprise environments.

The end payload is PureLog Stealer , a .NET information stealer built to harvest browser credentials, cookies, autofill data, browsing history, cryptocurrency wallet information, and host reconnaissance data.

The data is intentionally stored in an encoded decimal format rather than as Base64, hexadecimal, or raw PE files.

The research notes support for major browsers including Chrome, Edge, Firefox, Brave, and Opera, along with wallet targets such as MetaMask, Exodus, Atomic Wallet, Electrum, and Trust Wallet.

That scope makes the malware especially dangerous because stolen session cookies and tokens can bypass password resets and, in some cases, MFA protections.

This campaign is a strong reminder that initial access often arrives through ordinary-looking files and legitimate platform abuse rather than obvious malware downloads.

Security teams should treat Invoke-RestMethod plus Invoke-Expression , execution-policy bypasses, suspicious .js downloads, and abnormal child processes from wscript.exe as high-signal telemetry.

Monitoring PowerShell script block logging, process lineage, and memory-resident .NET execution is especially important because those are the main places this attack leaves evidence.

Mayura Kathir is a cybersecurity reporter at GBHackers News, covering daily incidents including data breaches, malware attacks, cybercrime, vulnerabilities, zero-day exploits, and more.

A new campaign linked to the TimbreStealer information stealer that specifically targets Mexican companies, employing…

A Mac-targeting ClickFix campaign amplified through a verified X ad, and a novel browser-based…

A newly disclosed forensic investigation has revealed that Pegasus spyware was used to hack a…

Scammers are exploiting consumers’ trust in household and financial brands by deploying polished fake Google…

Alibaba is reportedly preparing to ban the use of Anthropic’s Claude Code across its internal…

Threat actors are currently exploiting sophisticated ClickFix social engineering campaigns that mimic Google and Cloudflare…