Sophisticated Malware Framework Delivers Stealthy Payloads via Compromised Websites and Social Engineering
A highly complex malware delivery framework has been uncovered by Securonix, exploiting compromised websites and social engineering tactics to infect users with information stealers. Dubbed “Veil#Drop”, this multi-stage framework uses JavaScript launchers, PowerShell download cradles, and Blogspot-hosted payloads to evade traditional antivirus solutions and maintain operational stealth throughout the infection lifecycle.
The infection chain begins innocently enough, with a JavaScript file posing as a document designed to launch PowerShell code. This code is cleverly crafted to evade execution policies, allowing it to retrieve additional payloads from attacker-controlled Blogspot pages. The payload itself displays a decoy document, terminates specific processes, and decrypts embedded content – all while generating additional Blogspot URLs and executing subsequent payloads directly in memory.
One of the most striking aspects of Veil#Drop is its use of XOR-encoded .NET assemblies stored as large embedded data blobs. These encoded payloads are reconstructed and decrypted at runtime, making it extremely difficult for security software to detect them using traditional signature-based detection mechanisms. Furthermore, the framework abuses trusted Microsoft-signed binaries for code execution and defense evasion, demonstrating a deliberate effort to evade even the most basic antivirus solutions.
The ultimate payload delivered by Veil#Drop is PureLog Stealer, a .NET-based information stealer that performs system reconnaissance and starts harvesting data from popular browsers, including Google Chrome, Microsoft Edge, Firefox, Brave Browser, Opera, and Chromium-based browsers. This malware targets credentials, cookies, autofill data, session tokens, browsing histories, and other sensitive information stored in the browsers.
But PureLog Stealer doesn’t stop there – it also searches for cryptocurrency wallet information on the victim’s machine, as well as sensitive data from messaging applications, email clients, remote access software, FTP clients, cloud storage applications, developer tools, and password managers. The harvested information is then packaged and sent to attacker-controlled servers in an encrypted form.
Given PureLog Stealer’s extensive data harvesting capabilities, a single infected workstation could lead to broader environment compromise, depending on the credentials, tokens, keys, and other secrets stored on the system. In enterprise environments, information stealers like PureLog Stealer are frequently the first stage of larger intrusion campaigns, with stolen credentials potentially used to deploy ransomware, conduct data theft operations, or facilitate long-term espionage activities.
So what can users do to protect themselves from this type of attack? The key is to be cautious when interacting with unsolicited documents and files, especially those hosted on compromised websites. It’s also essential to keep all software up-to-date, including web browsers and operating systems, to ensure that any vulnerabilities are patched in a timely manner. Furthermore, users should be mindful of their browser extensions and plugins, as these can often serve as entry points for malware.
Ultimately, the success of Veil#Drop highlights the importance of robust cybersecurity measures, particularly in enterprise environments where sensitive data is at risk. By staying informed about the latest threats and taking proactive steps to secure their systems, users can reduce the likelihood of falling victim to sophisticated attacks like this one.
Source: SecurityWeek — 2026-07-06