Cybersecurity researchers have identified a new multi-stage malware delivery attack chain, dubbed VEIL#DROP, that leverages social engineering and Google's Blogger platform to…
PureLogs Stealer is a .NET-based information stealer deployed in the VEIL#DROP malware chain. It harvests sensitive data from compromised hosts, including credentials…
Windows Script Host was used to execute the initial JavaScript payload in the VEIL#DROP campaign, launching PowerShell with execution policy bypasses.
regsvcs.exe, a Microsoft-signed binary, was used as a living-off-the-land binary in the VEIL#DROP campaign for fallback execution of .NET assemblies.
installutil.exe, a Microsoft-signed binary, was used as a living-off-the-land binary in the VEIL#DROP campaign for fallback execution of .NET assemblies.
msbuild.exe, a Microsoft-signed binary, was used as a living-off-the-land binary in the VEIL#DROP campaign for fallback execution of .NET assemblies.
aspnet_compiler.exe, a Microsoft-signed binary, was used as a living-off-the-land binary in the VEIL#DROP campaign for fallback execution of .NET assemblies.