Loading malware…
Pure Logs Stealer is an information-stealing malware family in the broader “Pure” malware suite. Reported capabilities include theft of passwords, credit card numbers, session cookies, and local cryptocurrency wallet files stored in browsers and on infected systems. It has been associated with the Lone None threat actor, including a scam campaign active since at least November 2024 that used fake legal takedown emails in multiple languages to lure victims into downloading archive files containing malware disguised as evidence documents such as PDFs or PNGs. The campaign used DLL side-loading to execute the malware and bypass security checks.
Early Pure Logs Stealer samples linked to Lone None used Telegram bots to exfiltrate stolen credentials and host information via bot messages. More recent samples used Telegram bot user profiles to store part of a second-stage payload URL, with the profile string used as a path component for a temporary file-hosting service; one example combined payload URL provided in the reporting was hxxps://paste.rs/qDTxA. The malware has been observed in campaigns targeting personal and financial information, especially cryptocurrency, and collected data was reported as being rapidly exfiltrated via Telegram. Pure Logs Stealer has also been delivered alongside or in campaigns related to Lone None Stealer (aka PXA Stealer).
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
“Some early samples of Pure Logs Stealer associated with the Lone None threat actor use Telegram to exfiltrate stolen credentials and host information via bot messages.”
3 distinct techniques documented for this family, organized by ATT&CK tactic.
3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Other indicator types observed in public reporting.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Information stealer observed using Telegram bots to exfiltrate stolen credentials and host information; also described using Telegram bot profile content to provide/encode a second-stage URL leading to additional payload retrieval (e.g., a pastebin-hosted Python script).
Information stealer malware that exfiltrates passwords, credit card numbers, session cookies, and local crypto wallet files from victims' browsers and computers.
Named component of the broader 'Pure' malware suite; described as a logs/credential stealer.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.