Briefing
A Vietnamese threat group has escalated its phishing operations, deploying the “Lone None Stealer” and “PureLogs Stealer” through fake copyright infringement notices. This campaign utilizes DLL side-loading to compromise user endpoints, leading to the exfiltration of sensitive data and the diversion of cryptocurrency via clipboard hijacking. The attacker’s methods have been linked to dozens of active cryptocurrency wallets, underscoring a direct and quantifiable threat to digital asset holders.
Context
The digital asset landscape remains highly susceptible to social engineering tactics, where a lack of user vigilance combined with sophisticated malware deployment creates a persistent attack surface. Prior to this incident, a known class of vulnerability involved users inadvertently executing malicious code or approving transactions due to deceptive prompts, a risk amplified by the common practice of copy-pasting wallet addresses for transactions. This campaign leverages these foundational human and operational vulnerabilities.
Analysis
The incident’s technical mechanics initiate with a deceptive email, posing as a copyright takedown notice, that directs victims to download a malicious compressed archive. Upon execution, a DLL side-loading technique abuses legitimate Windows programs to install a Python installer, which then deploys obfuscated Python scripts. These scripts deliver two primary malware strains → PureLogs Stealer, designed for broad data exfiltration, and Lone None Stealer, which specifically targets cryptocurrency by monitoring the system clipboard and replacing legitimate wallet addresses with attacker-controlled ones during transactions. The threat actors further enhance stealth and resilience by utilizing Telegram bot profile pages for command-and-control infrastructure.
Parameters
- Victim Profile → Individual cryptocurrency users
- Attack Vector → Phishing, Social Engineering, Malware (DLL Side-loading, Clipboard Hijacking)
- Malware Names → Lone None Stealer (PXA Stealer), PureLogs Stealer
- Command & Control (C2) → Telegram bots
- Targeted Assets → Bitcoin, Ethereum, Solana, Ripple, other digital assets
- Initial Access → Fake copyright takedown notices via email
- Date of Lone None Stealer First Observation → June 2025
- Campaign Activity → Active since late 2024
Outlook
Immediate mitigation requires heightened user scrutiny of all incoming communications, especially those demanding urgent action or containing unexpected attachments. Users must verify sender authenticity, avoid untrusted downloads, and double-check all copied wallet addresses before initiating transactions. Protocols and platforms should advocate for the widespread adoption of hardware wallets and implement robust client-side security education. This incident will likely drive further development in endpoint detection and response (EDR) solutions specifically tailored to detect evasive malware leveraging legitimate system processes and encrypted C2 channels.
