Loading story…
A Vietnamese cybercriminal group known as Lone None has orchestrated a sophisticated phishing campaign that leverages fake copyright infringement notices to target individuals and organizations globally. The campaign, active since at least November 2024, begins with emails purporting to be from legitimate law firms, demanding the removal of allegedly infringing content from the recipient’s website or social media accounts. These emails are highly convincing, often referencing the recipient’s real online profiles and are translated into at least ten languages, including English, French, German, and Chinese, indicating a broad international targeting strategy. The phishing messages contain links that direct victims to download compressed archives, such as ZIP files, which masquerade as legal evidence documents in formats like PDF or PNG. Upon extraction, these archives contain malware that is executed using DLL side-loading, a technique that abuses trusted, signed applications—such as Microsoft Word or PDF readers—to bypass security controls and run malicious code undetected. The campaign delivers two primary types of information-stealing malware: Pure Logs Stealer and the more recent Lone None Stealer, also known as PXA Stealer. Pure Logs Stealer is designed to harvest a wide array of sensitive data, including passwords, credit card details, session cookies, and cryptocurrency wallet files stored on the victim’s device. The Lone None Stealer, first tracked by Cofense Intelligence in June 2025, is specifically engineered to target cryptocurrency assets. It monitors the victim’s clipboard for copied crypto wallet addresses and surreptitiously replaces them with addresses controlled by the attackers, thereby redirecting any intended cryptocurrency transfers. The campaign’s technical sophistication is further demonstrated by its use of Telegram bot profile pages for initial payload delivery and the deployment of obfuscated, compiled Python scripts to evade detection. Cofense Intelligence has observed that Lone None Stealer has appeared in 29% of all active threat reports involving Pure Logs Stealer since June 2025, highlighting its growing prevalence. The attackers also employ machine translation or AI tools to generate new email templates, allowing them to rapidly adapt and expand their reach. To further evade analysis and detection, the campaign abuses legitimate software such as Haihaisoft, leveraging their signed binaries for malicious purposes. The ongoing evolution of the campaign’s tactics, techniques, and procedures (TTPs) demonstrates a high level of operational agility and technical capability. The campaign’s focus on both personal and financial data, with a particular emphasis on cryptocurrency theft, poses significant risks to individuals and organizations alike. Security researchers recommend heightened vigilance for unsolicited legal notices, especially those containing download links or attachments, and advise organizations to implement robust email filtering and endpoint protection measures. The use of legitimate-looking legal threats and multi-language support increases the likelihood of successful social engineering, making this campaign particularly dangerous for a global audience. The campaign’s reliance on trusted software for malware execution underscores the importance of monitoring for unusual process behaviors and regularly updating security controls to detect DLL side-loading techniques. Organizations are urged to educate employees about the risks of phishing emails and to verify the authenticity of any legal correspondence received via email.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
By late September 2025, reporting on the campaign revealed that Lone None was using Telegram bots both for malware staging and as a primary command-and-control channel. Researchers also tied the operation to ongoing theft of personal, financial, and cryptocurrency-related information.
Cofense reported a notable rise in the use of the newer Lone None Stealer, also called PXA Stealer, starting in June 2025. This malware focused heavily on cryptocurrency theft, including replacing copied wallet addresses to redirect funds.
In the earlier phase of the campaign, the attackers used DLL side-loading to execute malware disguised as evidence documents and deliver Pure Logs Stealer. The technique helped the malware evade security controls while harvesting victim data.
A Vietnamese threat actor tracked as Lone None began running a phishing campaign by at least November 2024, sending fake legal or copyright takedown notices to trick targets into opening malware-laced files. The operation used multilingual lures, indicating broad international targeting.
3 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcehackread.com
Open sourcecofense.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Hackers have launched a sophisticated phishing campaign that impersonates official notices from the National Police of Ukraine to target organizations running Microsoft Windows. The campaign begins with emails containing malicious Scalable Vector Graphics (SVG) files, which are exploited due to their text-based nature that allows embedding of harmful scripts. When recipients open the SVG attachment, they are presented with a deceptive loading screen, after which the system downloads password-protected ZIP archives such as ergosystem.zip or smtpB.zip. The password is provided in the email to increase the appearance of legitimacy. Inside these archives, a Compiled HTML Help (CHM) file acts as the main trigger, executing a malicious script known as CountLoader. This loader connects to a remote server, exfiltrates basic system information, and then delivers the final malware payloads directly into memory, making detection challenging. The two primary payloads identified are Amatera Stealer, which is designed to steal sensitive data, and PureMiner, a cryptominer that hijacks system resources for illicit cryptocurrency mining. PureMiner is delivered using DLL sideloading techniques from the ZIP archive, while Amatera Stealer is deployed through the same infection chain. Security researchers have highlighted the dual threat posed by this campaign: data theft and resource hijacking. The use of SVG files is particularly concerning because they can contain embedded JavaScript and HTML, and on Windows systems, they are often opened by Microsoft Edge, which may lack adequate security controls if not the user's primary browser. The attackers use formal legal language in the phishing emails to pressure recipients into compliance, increasing the likelihood of infection. The campaign is notable for its fileless approach, as the malware is loaded directly into memory rather than being written to disk. This method complicates detection and remediation efforts for security teams. The infection chain leverages social engineering, technical obfuscation, and multiple stages to maximize its effectiveness. Researchers have also observed creative obfuscation within the SVG files, such as disguising malicious code with food and recipe-related variable names. The campaign demonstrates a high level of technical sophistication and adaptability, exploiting both human and technical vulnerabilities. Organizations are advised to educate users about the risks of opening unexpected attachments, especially SVG files, and to implement robust endpoint protection capable of detecting fileless threats. The campaign underscores the ongoing evolution of phishing tactics and the need for continuous vigilance in email security. Security teams should review their email filtering and endpoint monitoring policies to address this emerging threat vector. The use of password-protected archives and legitimate-seeming legal notices increases the campaign's success rate, making it a significant concern for enterprises.
Jun 29, 2026
Security researchers warned that corporate users are facing sustained phishing activity that relies heavily on social engineering, including emails impersonating CEOs and executives and messages posing as copyright complaints, business proposals, recruiting outreach, and AI video tool offers. In the executive-impersonation cases, attackers used public webmail services such as Gmail and Hotmail to contact representative and recruiting inboxes, pressured recipients to reply or share messenger chat-room QR codes, and appeared to be conducting reconnaissance for follow-on compromise rather than delivering malware immediately. A separate long-running campaign tracked as **PyChain** was attributed to a Vietnam-linked threat actor dubbed **LoneNone**, which used ZIP archives and disguised executables to infect victims through multi-stage malware delivery. Recent samples abused a fake PDF executable built from `ADNotificationManager.exe` for DLL sideloading, then fetched an encrypted archive containing Python runtime components and obfuscated scripts that stole browser credentials, cookies, system information, and cryptocurrency wallet data. Researchers said the actor repeatedly changed delivery infrastructure and lures, using services and channels including GitHub, Dropbox, Telegram bots, paste sites, URL shorteners, and attacker-controlled hosts, while expanding phishing content into more than 30 languages.
Jun 29, 2026
A sophisticated phishing campaign has been identified targeting users across multiple Asian countries, including China, Taiwan, Japan, and Malaysia. The campaign initially surfaced in January 2025, when Fortinet researchers observed attacks in Taiwan utilizing the Winos 4.0 malware. By February, the threat actor had shifted tactics, deploying new malware families such as the HoldingHands Trojan and expanding operations to additional countries in the region. The attackers primarily targeted Microsoft Windows users, leveraging phishing emails that contained PDF attachments masquerading as official documents from ministries of finance and other government agencies. These malicious PDFs included multiple embedded links, most of which were hosted on Tencent Cloud storage. Unique account IDs embedded in the URLs allowed analysts to attribute various malicious files to the same threat actor, revealing a coordinated and expansive campaign. The phishing documents evolved over time, with some later versions imitating government purchase orders and tax regulation drafts to increase their credibility and lure victims. The campaign’s primary focus appeared to be Chinese-speaking individuals, as evidenced by the prevalence of Chinese-named malware variants found on VirusTotal. The attackers employed advanced obfuscation techniques to evade detection and maintain persistence within targeted environments. The stolen information from these attacks is believed to be used for future operations, indicating a likely motivation of regional intelligence collection. The malware deployed in these campaigns often remained dormant after infection, awaiting further commands from the attackers. Researchers highlighted the strategic connections between seemingly unrelated attacks by analyzing shared infrastructure, code patterns, and operational tactics. The use of Tencent Cloud for hosting malicious payloads provided the attackers with scalability and a degree of anonymity. The campaign’s expansion from China to Taiwan, then Japan, and most recently Malaysia, demonstrates the threat actor’s adaptability and intent to broaden their reach. Security analysts recommend heightened vigilance for phishing emails, especially those purporting to be from government agencies, and advise organizations to monitor for suspicious activity related to Tencent Cloud links. The campaign underscores the ongoing threat posed by well-resourced actors conducting cross-border cyber operations in Asia. Organizations are urged to update their threat models and incident response plans to account for these evolving tactics. The high severity of the campaign is attributed to its broad geographic scope, advanced techniques, and potential for significant intelligence compromise.
Jun 29, 2026