PureLog Stealer

Threat actors are actively exploiting the recent Claude Code packaging error by hosting fake GitHub repositories that distribute trojanized archives. These archives contain a Rust-compiled dropper that deploys Vidar, GhostSocks, and PureLog Stealer to harvest credentials and establish residential proxies on compromised Windows systems.

The Talos 2025 Year in Review highlights a significant shift towards attackers targeting identity infrastructure and network components to bypass MFA and gain privileged access. Key threats include widespread exploitation of React2Shell, supply chain attacks targeting CI/CD pipelines, and the dominance of Qilin ransomware.

A targeted campaign is delivering the PureLog Stealer via localized copyright violation lures. The attack employs a sophisticated multi-stage infection chain, utilizing a Python-based loader to bypass AMSI, establish registry persistence, and execute the final .NET stealer entirely in memory to evade detection.