VEIL#DROP Campaign Uses Blogger-Hosted Stager to Deliver PureLogs Stealer
VEIL#DROP Campaign Uses Blogger-Hosted Stager to Deliver (TL-2026-1052), also tracked as VEIL#DROP, is a medium-severity malware campaign, first published 2026-07-01. It has no confirmed attribution, affects Microsoft Windows Script Host, maps to 30 MITRE ATT&CK techniques (T1005, T1027, T1036.007), and is covered by 9 detection rules and 15 indicators of compromise.
Key facts for TL-2026-1052
- Threat ID
- TL-2026-1052
- Also known as
- VEIL#DROP, Veil Drop
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-01
- Last reviewed
- 2026-07-01
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- unspecified broad targeting
- Target regions
- global
- Detection rules
- 9
- Indicators of compromise
- 15
Malware and tooling in VEIL#DROP Campaign Uses Blogger-Hosted Stager to Deliver
Malware and tooling: PureLogs Stealer, InstallUtil.exe, MSBuild.exe, RegSvcs.exe, aspnet_compiler.exe
A campaign dubbed VEIL#DROP, identified by Securonix researchers, uses a deceptively named JavaScript file (e.g., transcript.pdf.js) executed via Windows Script Host to launch a PowerShell stage that retrieves a next-stage payload hosted on Blogger, displaying a benign webpage while silently deploying the PureLogs Stealer, a .NET-based infostealer, to harvest credentials, cookies, autofill data, and cryptocurrency wallets.
How VEIL#DROP Campaign Uses Blogger-Hosted Stager to Deliver works
VEIL#DROP is a multi-stage malware delivery chain documented by Securonix researchers Akshay Gaikwad, Shikha Sangwan, and Aaron Beardslee, published 2026-07-01. The infection begins with a deceptively named JavaScript file masquerading as a PDF document (e.g., transcript.pdf.js) distributed via spear-phishing or drive-by compromise. When opened, the file is executed through Windows Script Host (wscript.exe), which launches a PowerShell process with execution-policy checks disabled or bypassed. The PowerShell stage retrieves a next-stage payload hosted on Google Blogger (htlwub00klocate.blogspot[.]com), abusing the platform's trusted reputation to slip past web/URL reputation filters and proxy defenses. To further evade static URL signatures, the malware dynamically constructs unique Blogspot URLs by inserting randomly generated numbers of forward slashes into the request path, producing a polymorphic set of otherwise-identical endpoints. The retrieved payload is XOR-encoded; PowerShell decodes it at runtime and never writes the decoded stage to disk. The reconstructed .NET code is loaded reflectively directly into memory (fileless execution), and when direct reflective loading is blocked by endpoint controls, the operators fall back to abusing Microsoft-signed living-off-the-land binaries (LOLBins) — RegSvcs.exe, InstallUtil.exe, MSBuild.exe, and aspnet_compiler.exe — to execute the same .NET payload under a trusted process. While this chain runs silently, the PowerShell stage opens a benign web page (mimicking a PDF viewer or a legitimate Google-hosted page) to maintain the illusion that the user's originally clicked document opened normally. To reduce forensic evidence, the malware terminates the spawned wscript.exe process and deletes the original JavaScript dropper file from disk. The final payload is PureLogs Stealer, a commodity .NET-based information stealer sold as Malware-as-a-Service (MaaS) on underground forums since 2022 for as little as $150/month. PureLogs is a 64-bit C# stealer built from multiple staged assemblies, each packed with the commercial .NET Reactor packer; a resource-only assembly is decrypted with TripleDES and decompressed into a functional DLL that retrieves C2 server details, encryption keys, and campaign identifiers. Runtime modules are subsequently pulled from C2 /plugin endpoints, decrypted with AES-256, and executed entirely in memory. PureLogs harvests browser-stored passwords, cookies, autofill data, session tokens (enabling MFA/session-hijack bypass), over 100 cryptocurrency wallet browser extensions and desktop wallets, credentials from communication apps (Discord, Telegram, Signal), password managers (Bitwarden, LastPass, 1Password), and configuration/credential data from OpenVPN, FileZilla, WinSCP, Steam, and Outlook. It establishes persistence via Windows Registry Run-key modifications (HKLM/HKCU \Software\Microsoft\Windows\CurrentVersion\Run) and exfiltrates stolen data over HTTPS (443) to attacker-controlled C2 infrastructure, positioning follow-on operators for lateral movement and potential cloud-account compromise via stolen session cookies and credentials. No CVE, CVSS score, or CISA KEV entry is associated with this campaign; it relies entirely on social engineering, trusted-platform abuse, and living-off-the-land execution rather than a software vulnerability.
MITRE ATT&CK techniques used in TL-2026-1052
Collection
T1005 Data from Local System; T1560 Archive Collected Data
Defense Evasion
T1027 Obfuscated Files or Information; T1036.007 Double File Extension; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information; T1218.004 InstallUtil; T1218.009 Regsvcs/Regasm; T1218.010 Regsvr32; T1620 Reflective Code Loading
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1059.001 PowerShell; T1059.003 Windows Command Shell; T1059.005 Visual Basic; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1102 Web Service; T1105 Ingress Tool Transfer; T1573.001 Symmetric Cryptography
Discovery
T1082 System Information Discovery; T1083 File and Directory Discovery
command-and-control
Initial Access
T1189 Drive-by Compromise; T1566 Phishing
Impact
Credential Access
T1539 Steal Web Session Cookie; T1552.001 Credentials In Files; T1555.003 Credentials from Web Browsers
Persistence
T1547.001 Registry Run Keys / Startup Folder
defense-impairment
T1685 Disable or Modify Tools; T1685.005 Clear Windows Event Logs
Affected products and versions in VEIL#DROP Campaign Uses Blogger-Hosted Stager to Deliver
- Microsoft — Windows Script Host
Vulnerable versions: all supported Windows versions - Microsoft — PowerShell
Vulnerable versions: all supported versions - Microsoft — .NET Framework (RegSvcs.exe, InstallUtil.exe, MSBuild.exe, aspnet_compiler.exe LOLBins)
Vulnerable versions: all supported .NET Framework versions - Google — Blogger/Blogspot (abused as hosting infrastructure, not a vulnerability in the platform itself)
Remediation for VEIL#DROP Campaign Uses Blogger-Hosted Stager to Deliver
Immediate actions
- Block or restrict outbound access to *.blogspot.com from endpoints where document viewers should not initiate web requests
- Enable the ASR rule 'Block Win32 API calls from Office macros'-adjacent .NET script blocking rule BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550 to constrain untrusted .NET script execution
- Alert on and quarantine double-extension files such as *.pdf.js, *.doc.js, *.xls.js delivered via email or web download
- Disable Windows Script Host (wscript.exe/cscript.exe) execution for standard users where not business-required
- Monitor and alert on PowerShell invocations with -ExecutionPolicy Bypass or -ep bypass combined with network egress to blogspot.com
Workarounds
- Restrict user ability to execute .js files directly via Windows Script Host by reassigning the default handler for .js to Notepad or a text editor
- Enforce Registry Run-key change auditing (Sysmon Event ID 13) to catch PureLogs persistence installs
Longer-term hardening
- Deploy application control / AppLocker or WDAC policies restricting RegSvcs.exe, InstallUtil.exe, MSBuild.exe, and aspnet_compiler.exe from loading unsigned or network-retrieved .NET assemblies
- Deploy EDR with behavioral/in-memory detection capable of flagging reflective .NET assembly loading (T1620)
- Enable PowerShell Script Block Logging and Module Logging (Event ID 4104) across the fleet
- Force MFA re-authentication and session-token invalidation on anomalous session reuse to blunt stolen-cookie MFA bypass
- Implement credential-manager and password-manager vault encryption-at-rest hardening and monitor for bulk vault file access
Timeline of VEIL#DROP Campaign Uses Blogger-Hosted Stager to Deliver
- The broader 'Pure' malware family (PureCrypter, PureLogs, PureMiner, PureClipper, PureRAT) developed by threat actor 'PureCoder' is first distributed, establishing the .NET-based MaaS toolkit later used to build PureLogs.
- PureLogs Stealer first appears for sale on underground hacking forums as a standalone Malware-as-a-Service offering, priced around $99 for a one-year subscription and distributed via the @ThePureBot Telegram bot.
- Independent researchers (Derp, ANY.RUN, Flashpoint) publish deep-dive reverse-engineering and ecosystem analyses of PureLogs and the broader 'Pure' malware family.
- Netresec publishes network-forensics analysis of PureLogs C2 traffic patterns.
- Trend Micro publishes 'Copyright Lures Mask a Multi-Stage PureLog Stealer Attack on Key Industries,' documenting a separate PureLog Stealer campaign using copyright-infringement phishing lures against key industry verticals, confirming continued active tasking of the Pure family ahead of VEIL#DROP.
- Help Net Security reports PureLogs infostealer being delivered globally via steganographic techniques, indicating an active, evolving distribution ecosystem ahead of the VEIL#DROP campaign.
- The Hacker News and Infosecurity Magazine publish public reporting on VEIL#DROP, disclosing the htlwub00klocate.blogspot[.]com infrastructure and associated TTPs.
- Securonix researchers Akshay Gaikwad, Shikha Sangwan, and Aaron Beardslee identify and name the VEIL#DROP campaign, documenting the transcript.pdf.js -> PowerShell -> Blogger -> PureLogs delivery chain.
Sources cited for VEIL#DROP Campaign Uses Blogger-Hosted Stager to Deliver
- VEIL#DROP Malware Chain Uses Blogger Pages as Camouflage to Deliver PureLogs Stealer
- Veil#Drop Uses Google Blogspot to Deploy PureLog Stealer
- PureLogs Malware Analysis, Overview
- Don't Judge a PNG by Its Header: PURELOGS Infostealer Analysis
- Analysis of the Pure Malware Family: Unique and Growing Threat
- PureLogs: The Low-Cost Infostealer with a High-Impact Threat
- PureLogs Forensics
- PureLogs: Reverse Engineering a .NET RAT From the PureCoder Ecosystem
- PureLogs Stealer - Malware removal instructions
- PureLogs malware analysis with data theft techniques
- PureLogs infostealer is stealing credentials worldwide
- From infostealer to full RAT: dissecting the PureRAT attack chain
- Analyzing PureLogs Stealer: A .NET-Based Info-Stealer In Active Campaigns
- Hackers Hide PureLogs Infostealer in PawsRunner Loader
- Copyright Lures Mask a Multi-Stage PureLog Stealer Attack on Key Industries
Threats related to VEIL#DROP Campaign Uses Blogger-Hosted Stager to Deliver
- Google Blogger Automated Malware False Positive Locks Hundreds of Blogs — Platform-Wide Enforcement Error Triggered by Tightened Safe Browsing Post-VEIL#DROP (August 2026)
- Vidar Stealer 2.0 (Loadbaks) Distributed via Fake Game Cheats on GitHub and Reddit
- Latrodectus Phishing Campaign Delivering LummaStealer via 302-Redirect Domain Infrastructure (lufyfeo[.]org, 36-domain cluster)
- CloudZ RAT with Pheno Plugin Hijacks Microsoft Phone Link to Steal SMS and OTPs (Cisco Talos, 2026-05)
Detection coverage for TL-2026-1052
As of 2026-07-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1052 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.