VEIL#DROP Malware Chain Uses Blogger Platform to Deliver PureLogs Stealer

Cybersecurity researchers have flagged a new multi-stage malware delivery attack chain that uses social engineering and Blogger pages to deliver an information stealer called PureLogs. The activity has been codenamed VEIL#DROP by Securonix. It's suspected that the initial payloads are distributed either via spear-phishing or a drive-by compromise, which occurs when an unsuspecting user lands on

According to Securonix research reported by The Hacker News, the VEIL#DROP campaign is a multi-stage, fileless malware chain that abuses Google’s Blogger/Blogspot platform to host PowerShell payloads and ultimately deploy the PureLogs information-stealer in memory.[1][2][4] The infection starts from a JavaScript file masquerading as a PDF, launches PowerShell with execution policy bypass, fetches obfuscated next-stage code from dynamically generated Blogger URLs, and then loads PureLogs to exfiltrate credentials, browser data, cookies, cryptocurrency wallets, and host information while leaving minimal artifacts on disk.[2][4][5] From a CyberSE.AI perspective, VEIL#DROP illustrates how attackers weaponize trusted cloud services and living-off-the-land techniques (PowerShell, LOLBins, fileless .NET loading) to evade traditional defenses, which is directly relevant to AI ecosystems that depend on similar cloud, scripting, and automation stacks.[1][2][3][8] Organizations should use Continuous AI Red Teaming to simulate comparable fileless, cloud-staged attack paths against AI-enabled workflows, AI CISO Advisory to align detection and response policies with these techniques, and AI Supp