Executive Summary
Securonix Threat Research has identified a highly evasive malware campaign codenamed VEIL#DROP, which delivers the PureLog Stealer (a .NET-based information stealer). The campaign leverages legitimate infrastructure, specifically Google's Blogspot, to host secondary payloads, allowing the traffic to blend with normal web activity and bypass reputation-based filtering.
The attack chain is characterized by its fileless nature, using JavaScript files masquerading as PDFs to initiate PowerShell scripts. These scripts use XOR encoding, runtime mutation, and reflective code loading to execute the final payload entirely in memory. To ensure delivery, the framework employs a cascading fallback mechanism using trusted Microsoft-signed binaries (LOLBins) to bypass application control and allowlisting policies.
The business impact of VEIL#DROP is significant as PureLog Stealer targets sensitive browser data, session cookies, and cryptocurrency wallets. By harvesting session cookies, attackers can bypass multi-factor authentication (MFA) to access enterprise cloud environments or sell the credentials on underground marketplaces for further exploitation.