● Covered by 2 sources · 2 reportsMedium impact
VEIL#DROP Malware Chain Uses Blogger to Deliver PureLogs Stealer
Key points
- VEIL#DROP uses Blogger infrastructure to deliver PureLogs Stealer.
- JavaScript and PowerShell facilitate multi-stage infection chain.
- Payloads are hidden in compromised Blogspot pages.
- The delivery method circumvents traditional reputation-based defenses.
- Sensitive data is harvested from browsers and applications.
Introduction to VEIL#DROP
VEIL#DROP is a newly identified malware delivery framework that exploits trusted infrastructures like Google's Blogspot to spread the PureLogs Stealer.
The Infection Process
VEIL#DROP initiates contact through social engineering techniques like spear-phishing or drive-by downloads, delivering a JavaScript masquerading as a document. This document launches a PowerShell script that retrieves the next payload from Blogspot-hosted URLs.
The malware employs a sophisticated chain to execute payloads in memory, bypass signature-based detection, and avoid drawing suspicion by blending in with legitimate activities associated with trusted platforms.
Technical Composition
The VEIL#DROP framework features multi-stage components, including JavaScript launchers and PowerShell scripts that download additional payloads from compromised Blogspot pages. The payloads involve XOR-encoded .NET assemblies, loaded at runtime to protect against static analysis.
These scripts terminate specific processes, decrypt embedded codes, and execute them within memory, significantly reducing the chances of detection by security software.
Security Implications
The use of Google's infrastructure for hosting malware payloads allows the attackers to leverage trusted domains, making it challenging for traditional security measures to effectively counter the attack without risking false positives.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
How outlets covered it
Securonix has identified Veil#Drop, a multi-stage malware framework utilizing compromised Blogspot sites for distribution. This technique employs JavaScript and PowerShell to stealthily deliver the PureLog Stealer, which can harvest sensitive information from multiple browsers and applications.
A new malware delivery chain, named VEIL#DROP, employs social engineering and Blogger pages to deploy the PureLogs Stealer. The use of legitimate platforms enables attackers to circumvent traditional defenses and execute remote payloads silently.