VEIL#DROP Malware Chain Uses Blogger Platform to Deliver Pure Logs Stealer
Summary: Securonix codenamed VEIL#DROP a multi-stage chain that starts with a JavaScript file disguised as a document (e.g., transcript.pdf.js), runs through Windows Script Host and PowerShell with execution policy bypasses, and pulls its next stage from a Blogger page at htlwub00klocate.blogspot[.]com. The loader builds a unique blogspot URL per execution by inserting a random number of forward slashes, mutates placeholder values at runtime, executes in memory, and falls back to Microsoft-signed binaries such as regsvcs.exe, installutil.exe, msbuild.exe, and aspnet_compiler.exe to deploy PureLogs Stealer, a .NET infostealer offered as malware-as-a-service by an actor known as PureCoder.
Key Takeaway: The chain abuses Google's trusted Blogger infrastructure and Microsoft-signed binaries already on the endpoint, so reputation-based defenses and LOLBin blocking that depends on any single binary have nothing unusual to flag. A successful PureLogs infection does not stop at the endpoint - the harvested data can become the stepping stone to lateral movement and cloud infrastructure compromise.
Read the original at The Hacker News ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026