Securonix identified a sophisticated multi-stage malware delivery framework named Veil#Drop that abuses compromised websites and trusted cloud infrastructure (Blogspot) to deploy the PureLog information stealer. The infection chain starts with a JavaScript file that launches PowerShell code to retrieve payloads from attacker-controlled Blogspot pages. These payloads use XOR-encoded .NET assemblies loaded reflectively in memory, preventing static analysis and signature detection. The framework also uses fallback mechanisms involving trusted Microsoft-signed binaries (LOLBINs) for code execution and defense evasion. PureLog Stealer harvests extensive data from multiple Chromium-based browsers, messaging apps, email clients, remote access tools, FTP clients, cloud storage, developer tools, and password managers. Harvested data includes credentials, cookies, autofill data, session tokens, browsing histories, cryptocurrency wallet information, and other sensitive secrets. The malware exfiltrates this data encrypted to attacker servers, potentially enabling further attacks such as ransomware, business email compromise, and espionage.

The PureLog information stealer can compromise a wide range of sensitive data on infected systems, including browser credentials, session tokens, cryptocurrency wallets, and data from various applications. This can lead to significant data breaches and enable attackers to escalate their access within enterprise environments. The stolen credentials and secrets may facilitate subsequent malicious activities such as ransomware deployment, data theft, business email compromise, and long-term espionage campaigns. The use of fileless techniques and trusted infrastructure for payload delivery increases the difficulty of detection and forensic analysis.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Organizations should monitor for indicators of compromise related to Veil#Drop and PureLog Stealer, including unusual PowerShell activity and network connections to Blogspot-hosted payloads. Employ endpoint detection solutions capable of detecting fileless and reflective .NET loading techniques. Restrict or monitor the use of PowerShell and LOLBINs in the environment. Since the malware uses trusted cloud services for payload hosting, network controls and threat intelligence should be updated to detect malicious use of such services. No official fix or patch is currently documented.