Loading story…
Researchers have identified a multi-stage malware campaign dubbed VEIL#DROP that uses social engineering, Google Blogspot/Blogger pages, and native Windows tooling to deliver the PureLogs information stealer. The infection chain starts with a JavaScript file disguised as a document, including filenames such as transcript.pdf.js, which executes through Windows Script Host and launches PowerShell with execution-policy bypasses. Additional stages are then retrieved from attacker-controlled Blogspot pages, decrypted with XOR routines, and loaded largely in memory to limit forensic evidence on disk.
The malware chain uses dynamic URL generation, runtime mutation, reflective .NET loading, and fallback execution through Microsoft-signed living-off-the-land binaries including regsvcs.exe, installutil.exe, msbuild.exe, and aspnet_compiler.exe when direct in-memory execution is blocked. Researchers said the final PureLogs payload can steal browser credentials, cookies, autofill data, browsing history, cryptocurrency wallet information, and system details, creating a path for broader compromise that could extend to lateral movement and cloud intrusion while blending into legitimate administrative activity.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
Researchers described a multi-stage malware delivery chain dubbed VEIL#DROP that uses a JavaScript lure, PowerShell, Blogger/Blogspot-hosted staging pages, in-memory execution, and Microsoft-signed LOLBins to deploy the PureLogs/PureLog information stealer.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcethehackernews.com
Open sourceattack.mitre.org
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that the **Veil#Drop** malware framework is using compromised websites, disguised scripts, PowerShell, and Google Blogspot pages to deliver the **PureLog Stealer** payload entirely in memory. The campaign relies on fileless execution, custom XOR encoding, and reflective loading of .NET assemblies to avoid writing artifacts to disk, while also abusing trusted Microsoft-signed binaries including **`InstallUtil.exe`**, **`RegSvcs.exe`**, and **`MSBuild.exe`** to blend malicious activity with legitimate Windows processes. PureLog Stealer is designed to harvest browser credentials, cookies, autofill data, cryptocurrency wallet information, and host details, with researchers warning that stolen session cookies may be reused to bypass MFA protections. The activity aligns with MITRE ATT&CK technique **`T1218.004`**, which documents how attackers can misuse **InstallUtil** for signed binary proxy execution by triggering installer components embedded in .NET binaries. Detection guidance has highlighted **InstallUtil** as a high-signal LOLBIN when it uses the **`/u`** uninstall switch and establishes remote network connections, behavior associated with malicious code download, arbitrary code execution, lateral movement, and possible data exfiltration. Splunk has since consolidated that monitoring into a broader analytic for **Windows InstallUtil remote network connections**, underscoring continued defender focus on this execution method.
Aug 12, 2026
A multi-stage **PureLogs/PureLog Stealer** campaign is targeting organizations through fake Adobe Sign messages, copyright-violation lures, and Google Ads malvertising, with observed victim focus on healthcare and government entities in Germany and Canada and additional activity in the United States and Australia. The attack chain uses decoy documents and localized executables to trick users, then pulls encrypted payloads from attacker-controlled infrastructure including `quickdocshare[.]com`, `chickplaybox[.]com`, PixelDrain staging links, `logs[.]bestshopingday[.]com`, and `103.107.199.61`, with related outbound traffic also tied to `166[.]0[.]184[.]127`. The malware execution flow is heavily evasive and largely fileless, combining browser fingerprinting, RC4 decryption, steganography in PNG `iTXt` metadata, process environment variable abuse, PowerShell, AMSI bypass, and reflective loading of encrypted .NET components to run the stealer entirely in memory. Researchers said the campaign also abuses renamed legitimate tools, including WinRAR and a Python interpreter masquerading as `svchost.exe`, while establishing persistence through the `HKCU\Environment\UserinitMprLogonScript` registry key, capturing screenshots, and using redundant loaders and process injection to reduce forensic artifacts and improve resilience.
Aug 21, 2026
Researchers reported that updated **Vidar** infostealer campaigns are using steganography, fileless execution, and social-engineering lures to evade detection and steal corporate and consumer data. Point Wild and Intrinsec found infections delivered through fake GitHub repositories, compromised WordPress sites showing **ClickFix**-style fake CAPTCHA prompts, gaming cheat posts on Reddit and Discord, and bogus software promoted in YouTube videos and hosted on services such as Mediafire. In one chain, a fake tool named **NeoHub** dropped a malicious DLL disguised as a Microsoft Edge component and signed with counterfeit certificates impersonating GitHub and grow.com. The malware uses VBScript, obfuscated PowerShell, a Go-based loader, and trusted Windows binaries including `WScript`, `PowerShell`, and `RegAsm.exe` to fetch apparently harmless JPEG and TXT files that contain hidden Base64-encoded second-stage payloads, then reconstructs and executes them entirely in memory through .NET reflective loading. Researchers said Vidar now operates as a **Malware-as-a-Service** offering, uses Telegram and Dead Drop Resolver techniques via public Steam profiles to locate command-and-control infrastructure, and exfiltrates credentials, cookies, payment data, cryptocurrency wallet files, and information from more than 200 browser extensions, often through Telegram and Cloudflare-fronted domains to mask attacker activity.
Jun 29, 2026