# VEIL#DROP Campaign Uses Blogger-Hosted Stager to Deliver PureLogs Stealer

> A campaign dubbed VEIL#DROP, identified by Securonix researchers, uses a deceptively named JavaScript file (e.g., transcript.pdf.js) executed via Windows Script Host to launch a PowerShell stage that retrieves a next-stage payload hosted on Blogger, displaying a benign webpage while silently deploying the PureLogs Stealer, a .NET-based infostealer, to harvest credentials, cookies, autofill data, and cryptocurrency wallets.

- **Published:** 2026-07-01T00:00:00Z
- **Last reviewed:** 2026-07-01T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1052
- **ID:** TL-2026-1052
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)

## Description

VEIL#DROP is a multi-stage malware delivery chain documented by Securonix researchers Akshay Gaikwad, Shikha Sangwan, and Aaron Beardslee, published 2026-07-01. The infection begins with a deceptively named JavaScript file masquerading as a PDF document (e.g., transcript.pdf.js) distributed via spear-phishing or drive-by compromise. When opened, the file is executed through Windows Script Host (wscript.exe), which launches a PowerShell process with execution-policy checks disabled or bypassed. The PowerShell stage retrieves a next-stage payload hosted on Google Blogger (htlwub00klocate.blogspot[.]com), abusing the platform's trusted reputation to slip past web/URL reputation filters and proxy defenses. To further evade static URL signatures, the malware dynamically constructs unique Blogspot URLs by inserting randomly generated numbers of forward slashes into the request path, producing a polymorphic set of otherwise-identical endpoints. The retrieved payload is XOR-encoded; PowerShell decodes it at runtime and never writes the decoded stage to disk. The reconstructed .NET code is loaded reflectively directly into memory (fileless execution), and when direct reflective loading is blocked by endpoint controls, the operators fall back to abusing Microsoft-signed living-off-the-land binaries (LOLBins) — RegSvcs.exe, InstallUtil.exe, MSBuild.exe, and aspnet_compiler.exe — to execute the same .NET payload under a trusted process. While this chain runs silently, the PowerShell stage opens a benign web page (mimicking a PDF viewer or a legitimate Google-hosted page) to maintain the illusion that the user's originally clicked document opened normally. To reduce forensic evidence, the malware terminates the spawned wscript.exe process and deletes the original JavaScript dropper file from disk. The final payload is PureLogs Stealer, a commodity .NET-based information stealer sold as Malware-as-a-Service (MaaS) on underground forums since 2022 for as little as $150/month. PureLogs is a 64-bit C# stealer built from multiple staged assemblies, each packed with the commercial .NET Reactor packer; a resource-only assembly is decrypted with TripleDES and decompressed into a functional DLL that retrieves C2 server details, encryption keys, and campaign identifiers. Runtime modules are subsequently pulled from C2 /plugin endpoints, decrypted with AES-256, and executed entirely in memory. PureLogs harvests browser-stored passwords, cookies, autofill data, session tokens (enabling MFA/session-hijack bypass), over 100 cryptocurrency wallet browser extensions and desktop wallets, credentials from communication apps (Discord, Telegram, Signal), password managers (Bitwarden, LastPass, 1Password), and configuration/credential data from OpenVPN, FileZilla, WinSCP, Steam, and Outlook. It establishes persistence via Windows Registry Run-key modifications (HKLM/HKCU \Software\Microsoft\Windows\CurrentVersion\Run) and exfiltrates stolen data over HTTPS (443) to attacker-controlled C2 infrastructure, positioning follow-on operators for lateral movement and potential cloud-account compromise via stolen session cookies and credentials. No CVE, CVSS score, or CISA KEV entry is associated with this campaign; it relies entirely on social engineering, trusted-platform abuse, and living-off-the-land execution rather than a software vulnerability.

## MITRE ATT&CK

- T1566 Phishing
- T1189 Drive-by Compromise
- T1059.003 Windows Command Shell
- T1059.001 PowerShell
- T1059.005 Visual Basic
- T1204.002 Malicious File
- T1547.001 Registry Run Keys / Startup Folder
- T1620 Reflective Code Loading
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1218.010 Regsvr32
- T1218.004 InstallUtil
- T1218.009 Regsvcs/Regasm
- T1070.004 File Deletion
- T1685.005 Clear Windows Event Logs
- T1036.007 Double File Extension
- T1102 Web Service
- T1685 Disable or Modify Tools
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1552.001 Credentials In Files
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1005 Data from Local System
- T1560 Archive Collected Data
- T1105 Ingress Tool Transfer
- T1071.001 Web Protocols
- T1573.001 Symmetric Cryptography
- T1102 Web Service
- T1041 Exfiltration Over C2 Channel
- T1531 Account Access Removal

## Sources

- [VEIL#DROP Malware Chain Uses Blogger Pages as Camouflage to Deliver PureLogs Stealer](https://thehackernews.com/2026/07/veildrop-malware-chain-uses-blogger.html)
- [Veil#Drop Uses Google Blogspot to Deploy PureLog Stealer](https://www.infosecurity-magazine.com/news/veil-drop-blogspot-purelog-stealer/)
- [PureLogs Malware Analysis, Overview](https://any.run/malware-trends/purelogs/)
- [Don't Judge a PNG by Its Header: PURELOGS Infostealer Analysis](https://www.swisspost-cybersecurity.ch/news/purelogs-infostealer-analysis-dont-judge-a-png-by-its-header)
- [Analysis of the Pure Malware Family: Unique and Growing Threat](https://any.run/cybersecurity-blog/pure-malware-family-analysis/)
- [PureLogs: The Low-Cost Infostealer with a High-Impact Threat](https://flashpoint.io/blog/purelogs-low-cost-infostealer-high-impact-threat/)
- [PureLogs Forensics](https://www.netresec.com/?page=Blog&month=2025-07&post=PureLogs-Forensics)
- [PureLogs: Reverse Engineering a .NET RAT From the PureCoder Ecosystem](https://www.derp.ca/plog-rat-analysis/)
- [PureLogs Stealer - Malware removal instructions](https://www.pcrisk.com/removal-guides/25567-purelogs-stealer)
- [PureLogs malware analysis with data theft techniques](https://www.dexpose.io/purelogger-deep-analysis-evasion-data-theft-and-encryption-mechanism/)
- [PureLogs infostealer is stealing credentials worldwide](https://www.helpnetsecurity.com/2026/05/19/purelogs-infostealer-delivery-steganography/)
- [From infostealer to full RAT: dissecting the PureRAT attack chain](https://www.bleepingcomputer.com/news/security/from-infostealer-to-full-rat-dissecting-the-purerat-attack-chain/)
- [Analyzing PureLogs Stealer: A .NET-Based Info-Stealer In Active Campaigns](https://undercodetesting.com/analyzing-purelogs-stealer-a-net-based-info-stealer-in-active-campaigns/)
- [Hackers Hide PureLogs Infostealer in PawsRunner Loader](https://gbhackers.com/hackers-hide-purelogs-infostealer/)
- [Copyright Lures Mask a Multi-Stage PureLog Stealer Attack on Key Industries](https://www.trendmicro.com/en_us/research/26/c/copyright-lures-mask-a-multistage-purelog-stealer-attack.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1052