Securonix says PureLogs infection starts with a fake PDF JavaScript file and uses PowerShell, fileless .NET loading, and LOLBins.
How I stopped a massive WordPress spam attack with 4,700 lines of code in two days - thanks to Codex and Claude ...