A sophisticated multi-stage malware delivery framework dubbed VEIL#DROP has emerged as a significant threat to enterprise environments by leveraging trusted cloud infrastructure and native operating system components to deploy the PureLog Stealer entirely in memory.
The campaign begins with highly deceptive social engineering tactics that use a malicious JavaScript file masquerading as a standard PDF document, such as transcript.pdf.js.
According to a detailed technical analysis published by Securonix Threat Research, experts Akshay Gaikwad, Shikha Sangwan, and Aaron Beardslee observed that this lightweight launcher executes through the Windows Script Host and spawns PowerShell with execution policy bypasses fully enabled.
This initial phase immediately establishes encrypted communication with attacker-controlled infrastructure.
Furthermore, as highlighted by security monitoring platform IntCyberDigest, the deployment of PureLog Stealer represents a growing trend where cybercriminals prioritize operational stealth over raw destructive power, opting for credential harvesting to facilitate long-term unauthorized access.
VEIL#DROP PureLog Memory Attack
Once the PowerShell instance is active, the VEIL#DROP framework initiates a complex download cradle utilizing the Invoke-RestMethod and Invoke-Expression cmdlets to retrieve subsequent payloads directly into system memory.
A defining characteristic of this operation is its extensive abuse of Google-owned Blogspot pages to host and distribute these intermediate stages.
By staging malicious code on highly reputable domains with valid SSL certificates, the threat actors effectively mask their network traffic, allowing it to blend seamlessly with legitimate web activity and bypass reputation-based filtering mechanisms.
The downloaded second-stage payload, often bearing a deceptive multi-extension filename like phud.dudus.docx.pdf.olp.sys, performs critical environment preparation by selectively terminating security and scripting processes while simultaneously downloading a benign decoy webpage to reassure the unsuspecting victim.
To further complicate forensic analysis and evade static signature detection, the embedded PowerShell and .NET payloads are heavily protected using custom XOR encoding algorithms.
The loader script decrypts this embedded content dynamically at runtime, iterating through the byte array with a repeating key pattern before reconstructing the executable code.
Additionally, the decoded script introduces polymorphic behavior through runtime mutation, replacing placeholder values with randomly generated strings and constructing unique Blogspot URLs for each execution.
This dynamic stage generation ensures that traditional indicators of compromise, such as static URLs and file hashes, change continuously across different infections, rendering standard threat intelligence feeds significantly less effective.
According to Securonix research, the culmination of the VEIL#DROP infection sequence involves the memory-only execution of the PureLog Stealer, a formidable NET-based information harvesting tool.
Indicators of Compromise
| Targeted Component | Examples of Compromised Data |
|---|---|
| Web Browsers | Saved passwords, authentication cookies, active session tokens |
| Cryptocurrency Wallets | MetaMask, Exodus, Atomic Wallet files, private keys |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
