Sophisticated Malware Framework Uses Blogspot to Deliver Information Stealers
A highly advanced malware delivery framework has been uncovered by Securonix, which utilizes compromised websites and social engineering tactics to infect users with information stealers. Dubbed “Veil#Drop”, this framework combines JavaScript launchers and PowerShell download cradles to deploy and execute malware hosted on Blogspot, a trusted infrastructure provided by Google.
The infection chain begins innocently enough, with a JavaScript file posing as a document that launches PowerShell code in an attempt to evade execution policies. The PowerShell then retrieves additional payloads from attacker-controlled Blogspot pages. These payloads are designed to display decoy documents, terminate specific processes, and decrypt embedded content. Once decrypted, the decoded code generates additional Blogspot URLs and executes subsequent payloads directly in memory.
At its core, Veil#Drop is a multi-stage malware delivery framework that leverages compromised websites, social engineering tactics, and trusted cloud services to evade traditional antivirus solutions. The use of XOR-obfuscated payloads, reflective .NET loading, fileless execution, and LOLBIN abuse further demonstrates the attackers’ deliberate effort to maintain operational stealth throughout the infection lifecycle.
The ultimate goal of Veil#Drop is to infect users with PureLog Stealer, a .NET-based information stealer that performs system reconnaissance and harvests sensitive data from various applications. This includes credentials, cookies, autofill data, session tokens, browsing histories, and other sensitive information stored in popular browsers such as Google Chrome, Microsoft Edge, Firefox, Brave Browser, Opera, and Chromium-based browsers.
Furthermore, PureLog Stealer can also extract information from messaging applications, email clients, remote access software, FTP clients, cloud storage applications, developer tools, and password managers. The harvested data is then packaged and sent to attacker-controlled servers in an encrypted form.
The extent of the damage caused by a single infected workstation cannot be overstated, as stolen credentials may later be used to deploy ransomware, conduct data theft operations, or facilitate long-term espionage activities. In enterprise environments, information stealers are often the first stage of larger intrusion campaigns, making it essential for organizations to prioritize robust security measures and threat detection.
For individuals and businesses alike, this latest malware framework serves as a stark reminder of the importance of maintaining up-to-date antivirus software, practicing safe browsing habits, and staying vigilant against social engineering tactics. By taking proactive steps to protect themselves from such sophisticated threats, users can significantly reduce their risk of falling victim to Veil#Drop or similar attacks.
Source: SecurityWeek — 2026-07-06