VEIL#DROP - JavaScript Masquerading as PDF Spawning PowerShell via WSH

Ethan Andrews@eandrews

•updated Jul 1, 2026•3•0•14

Detects execution of JavaScript files using a deceptive .pdf.js double-extension via Windows Script Host (wscript.exe/cscript.exe) that subsequently launch PowerShell. This activity is indicative of the initial stage of the VEIL#DROP attack chain used to deliver payloads like PureLog Stealer.