VEIL#DROP Malware Chain Uses Blogger Platform to Deliver PureLogs Stealer
VEIL#DROP malware chain uses Blogger to deliver PureLogs Stealer via JavaScript and PowerShell.
A new malware delivery chain, dubbed VEIL#DROP by Securonix, uses social engineering and Blogger pages to distribute the PureLogs information stealer. The attack begins with a JavaScript file that executes PowerShell with bypasses, which then retrieves a payload from a Blogger URL. This technique abuses Google's infrastructure to evade defenses and blend in with legitimate activity, ultimately deploying the .NET-based PureLogs Stealer.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Google?
Get an email when a new story names Google, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe VEIL#DROP campaign exploits trusted cloud infrastructure — specifically Google's Blogger platform — to host and deliver malicious payloads, effectively bypassing domain reputation and network-based defenses. The attack chain begins with a socially engineered JavaScript file that executes PowerShell with security bypasses, demonstrating how user interaction with untrusted files remains a critical entry point. By blending malicious traffic with legitimate Google service communications, the attackers make detection significantly harder for traditional security tools. This matters because even well-defended organizations may inadvertently allowlist traffic to Google's infrastructure, creating a blind spot that sophisticated threat actors actively exploit.
What helps against this
How we list vendors- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- DNS filtering and secure web gateway
Users cannot reach known-malicious sites, and malware cannot phone home.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- domain — htlwub00klocate.blogspot[.]com
- malware — PureLogs Stealer