VEIL#DROP Malware Chain Uses Blogger Platform to Deliver PureLogs Stealer

Cybersecurity researchers have identified a new multi-stage malware delivery attack chain, dubbed VEIL#DROP, that leverages social engineering and Google’s Blogger platform to deploy the PureLogs information stealer. The attack, detailed by Securonix, begins with a deceptive JavaScript file masquerading as a document (e.g., transcript.pdf.js) distributed via spear-phishing or drive-by compromise.

The infection chain executes through Windows Script Host, launching PowerShell with execution policy bypasses. The PowerShell script retrieves a next-stage payload hosted on Blogger, abusing Google’s trusted infrastructure to bypass reputation-based defenses. The downloaded payload creates a benign web page impression while silently deploying PureLogs Stealer, a .NET-based infostealer that harvests sensitive data.

The loader employs dynamic stage generation with runtime mutation, constructing unique blogspot.com URLs for each execution by inserting random forward slashes to evade static signatures. It uses XOR decryption, reflective code loading, and a cascading model of living-off-the-land binaries (LOLBins) like regsvcs.exe, installutil.exe, msbuild.exe, and aspnet_compiler.exe for fallback execution. The malware operates entirely in memory, leaving minimal forensic artifacts.

The impact extends beyond initial compromise, enabling lateral movement, persistence, and potential cloud infrastructure breaches. This campaign demonstrates sophisticated evasion techniques against traditional antivirus solutions.