# Veil#Drop Campaign Abuses Blogspot and PowerShell in Fileless Attacks Deploying PureLog Stealer


Securonix researchers have uncovered a sophisticated attack framework called Veil#Drop that leverages compromised websites, Google Blogspot hosting, and living-off-the-land techniques to deploy the PureLog information stealer while evading endpoint detection and response (EDR) systems. The discovery reveals a troubling trend: attackers continue to weaponize legitimate cloud services and abuse public-facing platforms to distribute malware while minimizing their operational footprint.


## The Threat: Veil#Drop Explained


Veil#Drop represents a multi-stage attack framework designed with evasion as its core principle. Rather than deploying malware directly, the framework uses a chain of obfuscated components to gradually introduce the PureLog stealer into target environments.


Key characteristics of Veil#Drop:


  • Multi-stage architecture with separation between reconnaissance, payload hosting, and execution
  • Fileless execution primarily through PowerShell to avoid disk-based detection signatures
  • Abuse of legitimate services including Google Blogspot and compromised third-party websites
  • Living-off-the-land techniques that leverage native Windows tools already present in target environments
  • Deployment of PureLog, an information stealer capable of exfiltrating sensitive credentials and data

    • The framework's name—combining "veil" (concealment) with "drop" (payload delivery)—reflects its operational methodology: remaining hidden while delivering malicious code.


    ## Attack Chain and Technical Details


    Securonix's analysis reveals a sophisticated multi-step attack progression:


    ### Stage 1: Initial Compromise

    The attack typically begins with compromised websites that serve as distribution nodes. Attackers either gain unauthorized access to existing websites or compromise WordPress installations and similar platforms to establish command and control (C2) infrastructure that appears legitimate.


    ### Stage 2: Blogspot Payload Hosting

    Rather than hosting malicious files on attacker-controlled infrastructure, the campaign abuses Google's Blogspot platform—a free, widely-trusted service. Blogspot's legitimate reputation makes the content less likely to be flagged by security filters and proxies.


    Why Blogspot?

  • Legitimate platform with strong reputation scores
  • Free to set up and maintain
  • Difficult to block without disrupting legitimate users
  • Traffic to Blogspot is often whitelisted in corporate environments
  • Provides plausible deniability for attackers

    • ### Stage 3: PowerShell Execution

    The actual malware deployment relies heavily on PowerShell, a native Windows management tool present on virtually all modern Windows systems. Attackers use encoded and obfuscated PowerShell commands to:


  • Download additional payloads from Blogspot-hosted repositories
  • Execute code in memory without writing to disk
  • Bypass execution policies through legitimate Windows APIs
  • Chain multiple PowerShell sessions to obscure the original command

    • ### Stage 4: PureLog Deployment

    Once the environment is prepared, PureLog—an information stealer—is injected into running processes. The stealer focuses on:


  • Browser credential harvesting (passwords, cookies, cached sessions)
  • Windows credential extraction from LSASS process memory
  • Keystroke logging capabilities
  • Document and file enumeration
  • Clipboard data exfiltration

    • ## Why This Campaign Matters Now


    The emergence of Veil#Drop highlights several critical concerns in the current threat landscape.


    Fileless attacks remain effective: Despite years of awareness about living-off-the-land techniques, they continue to evade detection. Many organizations still rely on signature-based and file-monitoring approaches that are blind to in-memory execution. The PowerShell-centric approach leverages tools that are often whitelisted or minimally monitored in enterprise environments.


    Cloud service abuse is escalating: Attackers have learned that compromising attacker infrastructure is riskier than abusing legitimate services. Google Blogspot, Microsoft OneDrive, SharePoint, and similar platforms offer attackers free infrastructure with enormous reputation advantages. Blocking these services isn't practical for most organizations, making them ideal for malware distribution.


    Information stealers remain the gateway threat: PureLog and similar tools are often precursors to more serious compromise. Once credentials are stolen, attackers gain legitimate access to systems, enabling lateral movement, data exfiltration, and ransomware deployment—all while appearing as authorized users.


    Supply chain compromise patterns continue: The reliance on compromised websites as distribution nodes suggests attackers are targeting content management systems and web applications with known vulnerabilities, using them as proxy infrastructure.


    ## Who Is Targeted?


    Securonix's reporting suggests Veil#Drop campaigns are broadly opportunistic, targeting:


  • Enterprise organizations via compromised external websites
  • Users visiting infected sites through drive-by downloads or social engineering
  • Employees in specific verticals selected for credential value (finance, healthcare, technology sectors)

    • The campaign does not appear to be highly targeted, suggesting attackers are casting a wide net and converting credentials from high-value systems opportunistically.


    ## Implications for Organizations


    | Risk Factor | Impact |

    |------------|--------|

    | Detection gaps | Fileless execution bypasses many endpoint tools |

    | Credential theft | Stolen credentials enable lateral movement and authorized-looking attacks |

    | Trust erosion | Legitimate services become attack vectors |

    | Regulatory exposure | Data theft can trigger breach notification and compliance penalties |

    | Incident response complexity | In-memory attacks leave minimal forensic evidence |


    ## Defensive Recommendations


    Organizations should implement a layered defense:


    ### Detection and Monitoring

  • Enable PowerShell logging at the script block level and monitor for obfuscated commands
  • Deploy behavioral analysis tools that detect process injection and suspicious in-memory activity
  • Monitor for base64 encoding and compression in command-line arguments—hallmarks of obfuscation
  • Track unsigned PowerShell scripts and execution policies that allow unsigned code

    • ### Network Defense

  • Block or monitor Blogspot domains in high-security environments where blogging platforms aren't business-critical
  • Implement DNS filtering to detect lookups to known malicious domains
  • Monitor DNS traffic for unusual patterns indicating stealer C2 communication
  • Apply reputation-based filtering that flags suspicious executables even from legitimate platforms

    • ### Credential Security

  • Deploy credential guards that prevent LSASS credential dumping
  • Enforce multi-factor authentication to reduce credential usability even if stolen
  • Monitor for suspicious authentication patterns (logins from new locations, unusual times, or suspicious IP ranges)
  • Implement privileged access management (PAM) to limit credential exposure

    • ### Incident Response

  • Assume breaches involving PureLog are credential-focused—begin credential rotation immediately
  • Hunt for related process injection and PowerShell execution across the environment
  • Check browser cookies and cached credentials in tools like Google Chrome and Microsoft Edge
  • Review file access and data exfiltration logs for signs of secondary compromise

    • ## HackWire Analysis


    Veil#Drop exemplifies a disturbing but predictable maturation in attack frameworks. Sophisticated threat actors have concluded that operational security through obfuscation and service abuse is more effective than aggressive malware distribution. By decomposing the attack across multiple legitimate platforms—a compromised website, Google Blogspot, native Windows tools, and in-memory techniques—they've created a campaign that is nearly forensically invisible.


    What's particularly alarming is the *opportunistic nature* of this approach. Veil#Drop isn't a precision sniper operation; it's a broadly cast net that exploits detection blindness at scale. The framework relies on the fact that most organizations remain poor at PowerShell telemetry, credential monitoring, and behavioral analysis. For defenders, this means the threat isn't the sophistication of the payload—it's the weakness of detection at each stage.


    The timeline matters too: we're seeing this technique in the wild *now*, at scale, which suggests it's proven effective. Attackers don't invest in multi-stage, evasion-first frameworks unless they're working. The shift from "build malware and host it on attacker infrastructure" to "abuse free cloud services and fileless execution" represents a meaningful evolution in attacker tradecraft.


    For organizations, the implication is clear: endpoint security alone cannot stop campaigns like Veil#Drop. You need behavioral monitoring, credential protection, PowerShell visibility, and cloud security controls working in concert. The bad news is this requires more work. The good news is these capabilities are increasingly table-stakes for mature security programs.


    — HackWire Editorial


    ## Related Coverage


  • Read more in our [Malware](https://www.hackwire.news/category/malware) coverage
  • Cross-reference with [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) and [Data Breaches](https://www.hackwire.news/category/breaches)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)