Loading story…
Researchers have identified a multi-stage malware campaign dubbed VEIL#DROP that uses social engineering, Google Blogspot/Blogger pages, and native Windows tooling to deliver the PureLogs information stealer. The infection chain starts with a JavaScript file disguised as a document, including filenames such as transcript.pdf.js, which executes through Windows Script Host and launches PowerShell with execution-policy bypasses. Additional stages are then retrieved from attacker-controlled Blogspot pages, decrypted with XOR routines, and loaded largely in memory to limit forensic evidence on disk.
The malware chain uses dynamic URL generation, runtime mutation, reflective .NET loading, and fallback execution through Microsoft-signed living-off-the-land binaries including regsvcs.exe, installutil.exe, msbuild.exe, and aspnet_compiler.exe when direct in-memory execution is blocked. Researchers said the final PureLogs payload can steal browser credentials, cookies, autofill data, browsing history, cryptocurrency wallet information, and system details, creating a path for broader compromise that could extend to lateral movement and cloud intrusion while blending into legitimate administrative activity.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Researchers described a multi-stage malware delivery chain dubbed VEIL#DROP that uses a JavaScript lure, PowerShell, Blogger/Blogspot-hosted staging pages, in-memory execution, and Microsoft-signed LOLBins to deploy the PureLogs/PureLog information stealer.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that updated **Vidar** infostealer campaigns are using steganography, fileless execution, and social-engineering lures to evade detection and steal corporate and consumer data. Point Wild and Intrinsec found infections delivered through fake GitHub repositories, compromised WordPress sites showing **ClickFix**-style fake CAPTCHA prompts, gaming cheat posts on Reddit and Discord, and bogus software promoted in YouTube videos and hosted on services such as Mediafire. In one chain, a fake tool named **NeoHub** dropped a malicious DLL disguised as a Microsoft Edge component and signed with counterfeit certificates impersonating GitHub and grow.com. The malware uses VBScript, obfuscated PowerShell, a Go-based loader, and trusted Windows binaries including `WScript`, `PowerShell`, and `RegAsm.exe` to fetch apparently harmless JPEG and TXT files that contain hidden Base64-encoded second-stage payloads, then reconstructs and executes them entirely in memory through .NET reflective loading. Researchers said Vidar now operates as a **Malware-as-a-Service** offering, uses Telegram and Dead Drop Resolver techniques via public Steam profiles to locate command-and-control infrastructure, and exfiltrates credentials, cookies, payment data, cryptocurrency wallet files, and information from more than 200 browser extensions, often through Telegram and Cloudflare-fronted domains to mask attacker activity.
Jun 29, 2026
Multiple campaigns are using phishing emails and archive-based lures to deliver remote access malware through stealthy, multi-stage infection chains. Point Wild documented **Remcos RAT**, **DesckVB RAT**, and a Rust-based **COVERT RAT** being delivered through ZIP attachments, weaponized `LNK` files, obfuscated JavaScript droppers, and hidden PowerShell execution, often with decoy documents to mask activity. The payloads were loaded filelessly through .NET reflection and in-memory execution, with operators abusing legitimate binaries and services such as `aspnet_compiler.exe`, GitHub, and paste or web-hosting platforms to stage malware while evading detection. Reported command-and-control infrastructure included `192.3.27.141:8087`, `172.245.246.77:8080`, and `181.231.253.69:4444`, while observed artifacts included `C:\ProgramData\remcos\logs.dat`, `C:\ProgramData\colors\logs.dat`, and payload names such as `ALTERNATE.dll`, `ClassLibrary3.dll`, `Keylogger.dll`, and `msedge_proxy.exe`. Separate reporting showed the same tradecraft extending beyond custom RATs to commodity remote-access software and credential theft. A campaign targeting Russian aerospace and aviation organizations used invoice-themed phishing and spoofed domains to install a portable **AnyDesk** instance for unattended access, maintain persistence with a scheduled task, minimize visibility with Tray Minimizer, and exfiltrate configuration data through a command-line SMTP mailer; Seqrite linked the activity to **Rare Werewolf (Librarian Ghouls)**. Securonix research cited by Trojan Killer described **VEIL#DROP** using fake document-style JavaScript files, Blogspot-hosted staging, PowerShell download cradles, XOR decoding, and in-memory .NET loading to deploy **PureLog Stealer**, which targets browser credentials, cookies, session tokens, wallet data, and host information. Across the campaigns, the common pattern is phishing-led initial access followed by LOLBins, PowerShell, staged downloads, persistence, and covert data theft or long-term remote control.
Jul 7, 2026
Researchers reported an active phishing campaign targeting Windows users with invoice-themed emails that deliver the **PawsRunner** loader and ultimately deploy the **PureLogs** `.NET` infostealer. The attack begins with a `TXZ` archive containing JavaScript that hides malicious commands in environment variables, launches hidden PowerShell, decrypts an AES- and Gzip-protected payload, and loads a .NET assembly filelessly through reflection. Investigators said PawsRunner has evolved from directly downloading PE files to extracting encrypted payloads hidden inside PNG images, using steganography markers in `iTXt` and `IEND` chunks while rotating user-agents and Windows networking APIs to blend in. The final payload, identified as **PureLogs 5.0.0**, profiles victims through WMI and steals data from browsers, wallet extensions, cryptocurrency wallets, communication apps, and other local applications before compressing and AES-encrypting exfiltrated data for HTTPS-based command-and-control. Reported indicators include the IP address `5.101.84.202`, the URL `hxxps://everycarebd[.]com/imagelkjh0987[.]png`, and six associated `SHA-256` hashes, with defenders also provided hunting queries for domains, URLs, IPs, and file hashes to support detection and incident response.
Jun 29, 2026