Hackers Abuse Blogspot and PowerShell Download Cradles to Deploy PureLog Steale

Cybersecuritynews •Tushar Subhra Dutta • July 3, 2026

Hackers have found a clever way to sneak data-stealing malware onto victims’ computers by hiding their tracks inside a trusted platform, Google Blogspot. Researchers recently uncovered a campaign abusing this blogging service alongside native Windows tools to quietly install an information stealer known as PureLog Stealer. The attack begins with something deceptively simple. A file […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Fileless PureLog Stealer Campaign Exploits Compromised Websites A sophisticated cyber campaign is leveraging compromised websites and a malicious JavaScript file named transcript.pdf.js to deploy PureLog Stealer, a .NET-based infostealer. The attack uses a fileless infection method, primarily through PowerShell and trusted Google Blogspot infrastructure, to execute payloads in memory, leaving minimal traces on disk. Victims are tricked into opening a file that appears to be a PDF, which actually executes a script to download the malware. PureLog Stealer targets major web browsers and cryptocurrency wallets, stealing sensitive data such as credentials, cookies, and autofill information. The campaign employs advanced evasion techniques, including XOR encoding and the use of legitimate Microsoft binaries to blend malicious activities with normal operations. This approach complicates detection and response efforts for security teams. Securonix has identified the framework as Veil#Drop, emphasizing the need for vigilance against such stealthy attacks. 5 sources 70

Extracted Entities

Hackers Abuse Blogspot and PowerShell Download Cradles to Deploy PureLog Steale

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (2)

Tools (1)