Attackers are using compromised websites and Google’s Blogspot service to infect Windows users with a data-stealing malware called PureLog. Securonix says the 'Veil#Drop' framework starts with a fake document JavaScript file that launches PowerShell, pulls later stages from attacker-controlled Blogspot pages, and runs payloads in memory using obfuscation, reflective .NET loading, and trusted Microsoft-signed binaries to evade detection. PureLog steals browser credentials, cookies, session tokens, wallet data, and secrets from messaging, email, FTP, cloud, remote-access, and developer tools.
Why it matters: This is dangerous because one infected employee computer can hand over passwords, tokens, and other secrets that attackers can later use for ransomware, business email compromise, or deeper intrusions. Organizations should block or scrutinize script-based downloads, hunt for suspicious PowerShell and LOLBIN activity, and reset exposed credentials if an infostealer infection is suspected.
Ionut Arghire
2026.07.06
100% relevant
This article establishes a distinct malware campaign centered on the Veil#Drop delivery framework and PureLog infostealer, not a previously tracked breach, CVE, or patch event.
← Back to all stories