Veil#Drop Uses Blogspot-Hosted Payloads to Deliver PureLog Stealer
Summary
Securonix describes Veil#Drop’s multi-stage infection chain, which uses JavaScript, PowerShell, and Blogspot-hosted payloads to deploy PureLog Stealer and harvest browser data, credentials, and other sensitive information.
Key points
- Securonix says the chain starts with a JavaScript file disguised as a document that launches PowerShell while evading execution policies.
- PowerShell retrieves payloads from attacker-controlled Blogspot pages; later stages decrypt embedded content and execute payloads in memory.
- A second-stage loader reconstructs and decrypts XOR-encoded .NET assemblies, while fallback mechanisms abuse Microsoft-signed binaries.
- The final payload, PureLog Stealer, targets credentials, cookies, autofill data, session tokens, browsing histories, and cryptocurrency wallet information.
- PureLog Stealer can also collect information from messaging, email, remote-access, FTP, cloud-storage, developer, and password-management applications.
- Securonix says the malware sends harvested information in encrypted form to attacker-controlled servers and warns that stolen secrets could enable further intrusions.
Article Details
- Attack Vectors
- A JavaScript file masquerading as a document launches PowerShell code that evades execution policies and retrieves payloads from attacker-controlled Blogspot pages.
- The payload uses a decoy document, terminates specific processes, and decrypts embedded content. Subsequent payloads are retrieved from generated Blogspot URLs and executed in memory.
- The infection chain uses XOR-encoded .NET assemblies, reflective loading, and trusted Microsoft-signed binaries for execution and defense evasion.
- PureLog Stealer harvests browser credentials, cookies, autofill data, session tokens, browsing histories, cryptocurrency wallet information, and data from other applications, then sends the collected information in encrypted form to attacker-controlled servers.
MITRE ATT&CK
T1005 · Data from Local SystemPureLog Stealer collects information from the victim’s machine, including browser data, wallet information, and data from messaging, email, remote access, FTP, cloud storage, developer, and password-manager applications.T1027 · Obfuscated Files or InformationThe second-stage loader stores .NET assemblies as XOR-encoded embedded data blobs.T1036.007 · Double File ExtensionThe infection uses multi-extension masquerading, and its initial JavaScript file is made to look like a document.T1059.001 · PowerShellThe JavaScript launcher starts PowerShell code, which retrieves additional payloads and evades execution policies.T1059.007 · JavaScriptA JavaScript file posing as a document acts as the launcher for the infection chain.T1105 · Ingress Tool TransferPowerShell retrieves payloads from attacker-controlled Blogspot pages, and later stages retrieve additional payloads from generated Blogspot URLs.T1140 · Deobfuscate/Decode Files or InformationThe loader reconstructs and decrypts embedded content at runtime, including XOR-encoded .NET assemblies.T1218 · System Binary Proxy ExecutionFallback mechanisms abuse trusted Microsoft-signed binaries for code execution and defense evasion.T1539 · Steal Web Session CookiePureLog Stealer harvests browser cookies and session tokens.T1555.003 · Credentials from Web BrowsersPureLog Stealer harvests credentials and other sensitive data stored in web browsers.T1620 · Reflective Code LoadingThe infection chain uses reflective .NET loading and executes subsequent payloads directly in memory.
Malware
Vendors
GoogleDubbed Veil#Drop, the framework combines JavaScript launchers and PowerShell download cradles for the deployment and execution of malware hosted on Blogspot, Google’s trusted infrastructure.MicrosoftThe sophisticated infection chain also contains several fallback mechanisms, abusing trusted Microsoft-signed binaries for code execution and defense evasion.
Products
BlogspotDubbed Veil#Drop, the framework combines JavaScript launchers and PowerShell download cradles for the deployment and execution of malware hosted on Blogspot, Google’s trusted infrastructure.BraveMicrosoft Edge, Firefox, Brave Browser, Opera, and Chromium-based browsers.Google ChromeIn the end, the victim’s machine is infected with PureLog Stealer, a .NET-based information stealer that performs system reconnaissance and starts harvesting data from Google Chrome.Microsoft EdgeMicrosoft Edge, Firefox, Brave Browser, Opera, and Chromium-based browsers.Mozilla FirefoxMicrosoft Edge, Firefox, Brave Browser, Opera, and Chromium-based browsers.OperaMicrosoft Edge, Firefox, Brave Browser, Opera, and Chromium-based browsers.