Hackers Use Compromised Websites and transcript.pdf.js Lure to Deliver PureLog Stealer

Gbhackers •Mayura Kathir • July 3, 2026

Hackers are using compromised websites and a deceptive transcript.pdf.js lure to deliver PureLog Stealer through a layered, fileless infection chain that leans heavily on PowerShell, trusted cloud infrastructure, and in-memory execution. The campaign, described in the attached research, shows how modern stealers increasingly rely on social engineering and living-off-the-land techniques rather than noisy malware binaries. […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Fileless PureLog Stealer Campaign Exploits Compromised Websites A sophisticated cyber campaign is leveraging compromised websites and a malicious JavaScript file named transcript.pdf.js to deploy PureLog Stealer, a .NET-based infostealer. The attack uses a fileless infection method, primarily through PowerShell and trusted Google Blogspot infrastructure, to execute payloads in memory, leaving minimal traces on disk. Victims are tricked into opening a file that appears to be a PDF, which actually executes a script to download the malware. PureLog Stealer targets major web browsers and cryptocurrency wallets, stealing sensitive data such as credentials, cookies, and autofill information. The campaign employs advanced evasion techniques, including XOR encoding and the use of legitimate Microsoft binaries to blend malicious activities with normal operations. This approach complicates detection and response efforts for security teams. Securonix has identified the framework as Veil#Drop, emphasizing the need for vigilance against such stealthy attacks. 5 sources 70

Extracted Entities

Hackers Use Compromised Websites and transcript.pdf.js Lure to Deliver PureLog Stealer

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (2)

Tools (1)