Hackers Abuse Blogspot and PowerShell Download Cradles to Deploy PureLog Steale

Researchers uncovered a Veil#Drop campaign that hides an information-stealer (PureLog Stealer) delivery chain inside Google Blogspot pages: victims open a file named like transcript.pdf.js which launches PowerShell with execution policy bypass, fetches staged payloads from Blogspot, performs in-memory decryption and reflective loading of .NET assemblies (avoiding disk writes), and resorts to signed Microsoft tools if needed; the stealer exfiltrates saved browser credentials, cookies, autofill data, browsing history, and cryptocurrency wallet information. The report includes filenames, Blogspot domains and URLs as IoCs and recommends restricting Windows Script Host, enabling PowerShell logging, monitoring outbound traffic to trusted cloud platforms for anomalous patterns, and applying application control and least privilege.