A fileless malware framework has been abusing Google's Blogspot platform to deliver the PureLog Stealer entirely in memory, letting attackers steal credentials while leaving few traces on disk. Securonix Threat Research, which named the framework Veil#Drop, said the campaign chains together compromised websites, a booby-trapped JavaScript file and PowerShell to reach its target. PureLog Stealer is a known .NET infostealer, but the multi-stage delivery route is what sets this operation apart. A Fileless Chain Built to Evade Detection The attack begun when a victim on a compromised website opened a file masquerading as a document. Because Windows hides known extensions by default, it appeared to be a PDF, but it was actually a script that Windows Script Host runs, launching PowerShell with…