TLDR Tech / InfoSec
Veil#Drop: Blogspot-Hosted PowerShell Loader Delivers PureLog Stealer Through XOR-Encoded In-Memory .NET Payloads
Veil#Drop is a multi‑stage PowerShell‑based framework that starts from a JavaScript file disguised as a document, then uses Windows Script Host to launch PowerShell with execution policy bypassed and pull further stages from attacker‑controlled Blogspot pages. Payloads are XOR‑encoded, decoded only in memory, and reconstructed into .NET assemblies that are loaded via reflection without touching disk. The campaign relies on compromised websites, document‑style multi‑extension filenames, LOLBIN‑based execution fallbacks, decoy content, cleanup of the initial launcher, and finally deploys PureLog Stealer to grab browser credentials, cookies, crypto wallets, and other user data.
Read the full story