New Lone None Stealer Malware Hijacks Crypto Wallets via Fake Copyright Takedown Notices

Cofense Intelligence has uncovered an evolving phishing campaign that uses copyright takedown notices as its primary lure, with the Lone None threat actor group deploying both the well-known Pure Logs Stealer and a newly identified strain dubbed Lone None Stealer (also known as PXA Stealer). The campaign spoofs legitimate legal firms to pressure victims into clicking malicious links, and Cofense notes that the emails often reference real Facebook accounts linked to the victim, boosting credibility.

Malicious links redirect through services such as tr[.]ee and goo[.]su, eventually delivering archive files hosted on Dropbox and MediaFire, while the attackers also abuse legitimate tools to evade analysis, including Haihaisoft PDF Reader and a Python installation staged in C:\Users\Public\Windows and renamed to svchost.exe.

Lone None Stealer specifically focuses on cryptocurrency theft by replacing clipboard-copped addresses with attacker-controlled ones and alerting the operator via Telegram, with activity linked to multiple wallet addresses across Bitcoin, Ethereum, Litecoin, Solana, Ripple and others. Cofense has tracked the group’s activity since late 2024, noting that payload sophistication has increased even as email lures remain largely unchanged.