Loading story…
Researchers reported that the Veil#Drop malware framework is using compromised websites, disguised scripts, PowerShell, and Google Blogspot pages to deliver the PureLog Stealer payload entirely in memory. The campaign relies on fileless execution, custom XOR encoding, and reflective loading of .NET assemblies to avoid writing artifacts to disk, while also abusing trusted Microsoft-signed binaries including InstallUtil.exe, RegSvcs.exe, and MSBuild.exe to blend malicious activity with legitimate Windows processes. PureLog Stealer is designed to harvest browser credentials, cookies, autofill data, cryptocurrency wallet information, and host details, with researchers warning that stolen session cookies may be reused to bypass MFA protections.
The activity aligns with MITRE ATT&CK technique T1218.004, which documents how attackers can misuse InstallUtil for signed binary proxy execution by triggering installer components embedded in .NET binaries. Detection guidance has highlighted InstallUtil as a high-signal LOLBIN when it uses the /u uninstall switch and establishes remote network connections, behavior associated with malicious code download, arbitrary code execution, lateral movement, and possible data exfiltration. Splunk has since consolidated that monitoring into a broader analytic for Windows InstallUtil remote network connections, underscoring continued defender focus on this execution method.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
Splunk Threat Research removed the detection analytic "Windows InstallUtil Uninstall Option with Network" from its content library because its coverage was replaced by "Windows InstallUtil Remote Network Connection." The record lists the update date as 2026-05-13.
MITRE ATT&CK published documentation for sub-technique T1218.004 describing how adversaries can abuse the legitimate Windows utility InstallUtil to proxy malicious code execution and bypass application control.
Securonix Threat Research described a fileless malware framework it named Veil#Drop that uses compromised websites, disguised scripts, PowerShell, and Google Blogspot pages to deliver the PureLog Stealer entirely in memory. The campaign also uses trusted LOLBINs including InstallUtil, RegSvcs, and MSBuild as fallback execution methods.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
infosecurity-magazine.com
Open sourceresearch.splunk.com
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers have identified a multi-stage malware campaign dubbed **VEIL#DROP** that uses social engineering, Google **Blogspot/Blogger** pages, and native Windows tooling to deliver the **PureLogs** information stealer. The infection chain starts with a JavaScript file disguised as a document, including filenames such as `transcript.pdf.js`, which executes through Windows Script Host and launches PowerShell with execution-policy bypasses. Additional stages are then retrieved from attacker-controlled Blogspot pages, decrypted with XOR routines, and loaded largely in memory to limit forensic evidence on disk. The malware chain uses dynamic URL generation, runtime mutation, reflective .NET loading, and fallback execution through Microsoft-signed living-off-the-land binaries including `regsvcs.exe`, `installutil.exe`, `msbuild.exe`, and `aspnet_compiler.exe` when direct in-memory execution is blocked. Researchers said the final **PureLogs** payload can steal browser credentials, cookies, autofill data, browsing history, cryptocurrency wallet information, and system details, creating a path for broader compromise that could extend to lateral movement and cloud intrusion while blending into legitimate administrative activity.
Jul 12, 2026
Multiple campaigns are using phishing emails and archive-based lures to deliver remote access malware through stealthy, multi-stage infection chains. Point Wild documented **Remcos RAT**, **DesckVB RAT**, and a Rust-based **COVERT RAT** being delivered through ZIP attachments, weaponized `LNK` files, obfuscated JavaScript droppers, and hidden PowerShell execution, often with decoy documents to mask activity. The payloads were loaded filelessly through .NET reflection and in-memory execution, with operators abusing legitimate binaries and services such as `aspnet_compiler.exe`, GitHub, and paste or web-hosting platforms to stage malware while evading detection. Reported command-and-control infrastructure included `192.3.27.141:8087`, `172.245.246.77:8080`, and `181.231.253.69:4444`, while observed artifacts included `C:\ProgramData\remcos\logs.dat`, `C:\ProgramData\colors\logs.dat`, and payload names such as `ALTERNATE.dll`, `ClassLibrary3.dll`, `Keylogger.dll`, and `msedge_proxy.exe`. Separate reporting showed the same tradecraft extending beyond custom RATs to commodity remote-access software and credential theft. A campaign targeting Russian aerospace and aviation organizations used invoice-themed phishing and spoofed domains to install a portable **AnyDesk** instance for unattended access, maintain persistence with a scheduled task, minimize visibility with Tray Minimizer, and exfiltrate configuration data through a command-line SMTP mailer; Seqrite linked the activity to **Rare Werewolf (Librarian Ghouls)**. Securonix research cited by Trojan Killer described **VEIL#DROP** using fake document-style JavaScript files, Blogspot-hosted staging, PowerShell download cradles, XOR decoding, and in-memory .NET loading to deploy **PureLog Stealer**, which targets browser credentials, cookies, session tokens, wallet data, and host information. Across the campaigns, the common pattern is phishing-led initial access followed by LOLBins, PowerShell, staged downloads, persistence, and covert data theft or long-term remote control.
Jul 12, 2026
A multi-stage **PureLogs/PureLog Stealer** campaign is targeting organizations through fake Adobe Sign messages, copyright-violation lures, and Google Ads malvertising, with observed victim focus on healthcare and government entities in Germany and Canada and additional activity in the United States and Australia. The attack chain uses decoy documents and localized executables to trick users, then pulls encrypted payloads from attacker-controlled infrastructure including `quickdocshare[.]com`, `chickplaybox[.]com`, PixelDrain staging links, `logs[.]bestshopingday[.]com`, and `103.107.199.61`, with related outbound traffic also tied to `166[.]0[.]184[.]127`. The malware execution flow is heavily evasive and largely fileless, combining browser fingerprinting, RC4 decryption, steganography in PNG `iTXt` metadata, process environment variable abuse, PowerShell, AMSI bypass, and reflective loading of encrypted .NET components to run the stealer entirely in memory. Researchers said the campaign also abuses renamed legitimate tools, including WinRAR and a Python interpreter masquerading as `svchost.exe`, while establishing persistence through the `HKCU\Environment\UserinitMprLogonScript` registry key, capturing screenshots, and using redundant loaders and process injection to reduce forensic artifacts and improve resilience.
Aug 21, 2026