Veil#Drop Framework Delivers PureLog Stealer via Blogspot

Securonix Threat Research has identified a sophisticated malware delivery framework dubbed Veil#Drop. The campaign employs a multi-stage infection chain that begins with social engineering, using JavaScript files masquerading as PDF documents (e.g., transcript.pdf.js) to execute code via Windows Script Host. This initial stage spawns PowerShell, which retrieves subsequent XOR-encoded payloads from attacker-controlled Blogspot pages, abusing Google's trusted infrastructure to evade reputation-based security controls.

The technical architecture of Veil#Drop is heavily focused on defense evasion and fileless execution. It utilizes custom XOR decryption and .NET reflection (Assembly.Load) to execute payloads entirely in memory, bypassing traditional disk-based antivirus. Furthermore, the framework includes robust fallback mechanisms that abuse several Microsoft-signed binaries (LOLBINs) such as RegSvcs, InstallUtil, and MSBuild to ensure payload delivery if primary methods fail. The final payload, PureLog Stealer, is a potent information-harvesting tool targeting browser credentials, cryptocurrency wallets, and sensitive system reconnaissance data.

This threat poses a significant risk to organizations due to its stealthy operational nature and its ability to bypass multi-factor authentication (MFA) by stealing active session cookies. The combination of trusted cloud staging, LOLBIN abuse, and fileless execution makes it a high-priority threat for detection engineering and incident response teams.