LHA Lure Drops PureLog Stealer and XWorm With 0/76 Persistence Layer

A purchase-order phishing campaign is circulating a ZIP/LHA double-extension archive across engineering, retail, and telecom firms in five countries. The .NET Reactor-obfuscated payload bundles PureLog Stealer and XWorm, while two persistence components — a VBS startup stub and a SetupComplete.cmd hook — each achieve zero antivirus detections. A TLS certificate CN mismatch to 'relaysession.com' on the DDNS command-and-control node provides the clearest pivot for hunting additional operator infrastructure.