{"id":1127,"date":"2026-08-19T20:10:44","date_gmt":"2026-08-19T14:40:44","guid":{"rendered":"https:\/\/www.hexnode.com\/threat-watch\/?p=1127"},"modified":"2026-08-19T20:12:01","modified_gmt":"2026-08-19T14:42:01","slug":"veil-malware-explained","status":"publish","type":"post","link":"https:\/\/www.hexnode.com\/threat-watch\/veil-malware-explained\/","title":{"rendered":"Veil Malware: How Attackers Use Blogspot to Deliver Fileless Payloads"},"content":{"rendered":"

A newly disclosed malware delivery framework known as Veil demonstrates how attackers are combining trusted cloud infrastructure, fileless execution, and multi-stage payload delivery to make endpoint compromise harder to detect. Rather than relying on a single malicious executable, the campaign chains together compromised websites, JavaScript, PowerShell, and Blogspot-hosted payloads to quietly deliver the PureLog information stealer while minimizing traditional forensic evidence.<\/p>\n

For enterprise security teams, the significance extends beyond another malware family. The veil malware campaign illustrates a broader shift in attacker tradecraft: legitimate services and trusted binaries are increasingly being used to bypass conventional security controls, forcing organizations to strengthen visibility across script execution, identity, endpoint behavior, and network activity instead of relying solely on reputation-based detection.<\/p>\n

How the Veil Attack Chain Works<\/h2>\n

The Veil malware (also referred to by Securonix as VEIL#DROP) campaign uses a layered execution chain that prioritizes stealth, trusted infrastructure, and in-memory execution over conventional malware delivery. Instead of delivering the final payload directly, each stage prepares the environment for the next, making the attack more resilient against signature-based detection and static analysis.<\/p>\n

Stage 1: Initial Access<\/h3>\n

The attack begins with a JavaScript file disguised as a PDF document, such as transcript.pdf.js. Because Windows commonly hides known file extensions, users may only see transcript.pdf, increasing the likelihood of execution through Windows Script Host (WSH). The script launches PowerShell with execution policy bypass arguments, establishing the first stage of the infection chain.<\/p>\n

Stage 2: Blogspot-Based Payload Delivery<\/h3>\n

Rather than downloading malware from attacker-owned infrastructure, the PowerShell script retrieves subsequent payloads from attacker-controlled Blogspot pages hosted on Google’s Blogger platform. Using a trusted cloud service allows outbound traffic to blend with legitimate web activity, potentially reducing the effectiveness of reputation-based URL filtering and domain-blocking controls.<\/p>\n

The downloaded script also opens a benign webpage to create the impression that the requested document has loaded successfully while the malicious execution continues in the background.
\n

<\/div>

Top 10 security challenges XDR helps address for enterprise teams<\/h4>

XDR helps enterprises reduce alert fatigue, connect threat signals, and respond faster to complex cyberattacks.<\/p><\/div><\/div><\/div><\/a><\/div><\/div><\/div><\/p>\n

Stage 3: Evasion and In-Memory Execution<\/h3>\n

After the secondary payload is retrieved, the framework employs multiple evasion techniques to minimize detection and forensic visibility, including:<\/p>\n