PureLog Stealer

the sophisticated framework abuses compromised websites, Blogspot, PowerShell, and fileless techniques to evade detection

That can help malicious traffic blend into normal web activity because the request appears to involve a familiar blog-hosting platform rather than an obviously malicious host.

ATTACK TECHNIQUES Social Engineering and Phishing collectively account for 13 of 38 technique-attributed incidents, making human manipulation the most prevalent attack category across the period.

The notification impersonated a security warning from GitHub and included a link to a fake GitHub website.

the script runs through wscript.exe or cscript.exe and launches powershell.exe with policy-bypass behavior... VEIL#DROP used Blogspot-hosted URLs to stage additional scripts and payloads.

When opened, the script runs through wscript.exe or cscript.exe and launches powershell.exe with policy-bypass behavior.

the framework combines JavaScript launchers and PowerShell download cradles

When opened, the script runs through wscript.exe or cscript.exe and launches powershell.exe with policy-bypass behavior.

The combination of compromised websites, multi-extension masquerading, trusted cloud services, XOR-obfuscated payloads, reflective .NET loading, fileless execution, and LOLBIN abuse demonstrates a deliberate effort to evade traditional antivirus solutions | the sophisticated framework abuses compromised websites, Blogspot, PowerShell, and fileless techniques to evade detection... executes subsequent payloads directly in memory.

The first file observed by researchers was named transcript.pdf.js. On systems where Windows hides known file extensions, a victim may notice the .pdf part and miss the real .js extension.

The retrieved file, named phud.dudus.docx.pdf.olp.sys, deletes the original JavaScript launcher to erase evidence

After the PowerShell stages run, VEIL#DROP decodes XOR-protected payload data and loads .NET assemblies through reflection.

It also includes fallback execution paths through trusted Microsoft-signed utilities such as RegSvcs.exe, InstallUtil.exe, MSBuild.exe, csc.exe, vbc.exe, ilasm.exe, and aspnet_compiler.exe.

VEIL#DROP decodes XOR-protected payload data and loads .NET assemblies through reflection. In plain terms, the malware tries to execute code directly in memory instead of leaving a normal PureLog.exe file behind.

Incident volume peaked in the middle period (25 events, March 10 to April 10), driven by the USD 280 million Drift heist and a surge in phishing and credential-theft campaigns targeting US-based financial institutions.

If PureLog ran, the exposed data may include browser credentials, cookies, session tokens, autofill entries

The practical risk is credential theft: saved browser passwords, cookies, autofill data, wallet data, and system information can be collected... If PureLog ran, the exposed data may include browser credentials, cookies, session tokens, autofill entries

The practical risk is credential theft: saved browser passwords, cookies, autofill data, wallet data, and system information can be collected... host reconnaissance details.

The script also takes a full-screen screenshot... then sends all of it to the command-and-control server via an HTTPS POST request.

The malware packages the harvested information and sends it to attacker-controlled servers in an encrypted form.

PowerShell commands, Blogspot visits, and trusted Microsoft utilities are things security teams see every day, which is why this approach slips past antivirus tools so easily.

VEIL#DROP used Blogspot-hosted URLs to stage additional scripts and payloads... Blogspot staging host for a PowerShell-retrieved payload.

The malware packages the harvested information and sends it to attacker-controlled servers in an encrypted form.

The script first bypasses Windows Defender’s Antimalware Scan Interface by patching memory directly, preventing the system from scanning what follows.