Fileless Malware Abuses Google Blogspot to Deploy Infostealer in Memory

Securonix researchers uncovered a fileless campaign called Veil#Drop that uses compromised websites and Blogspot-hosted payloads to deliver the PureLog .NET infostealer entirely in memory via malicious scripts and PowerShell; the chain reconstructs assemblies at runtime and abuses legitimate Microsoft-signed utilities (RegSvcs, InstallUtil, MSBuild) to evade detection, harvesting browser credentials, cookies (allowing MFA bypass), autofill data and cryptocurrency wallets—defenders are urged to detect behavioral indicators like PowerShell fetching from Blogspot and use of LOLBINs rather than relying solely on static IOCs.