Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Veil#Drop is a sophisticated multi-stage malware delivery framework that combines social engineering, compromised websites, malicious JavaScript launchers, PowerShell download cradles, and trusted cloud-hosted infrastructure to deploy PureLog Stealer entirely in memory. The infection chain begins with a deceptively named JavaScript file masquerading as a document (e.g., transcript.pdf.js), which executes through Windows Script Host and launches PowerShell with execution policy bypasses enabled.

Chris Jacob, Field CISO, Securonix There is a particular kind of unease that comes with geopolitical tension. It rarely arrives for security teams as one clean, obvious event. More often, it shows up as a change in tempo across the environment. Scanning increases and phishing attempts feel sharper. Then you start having leadership asking harder questions about exposure, suppliers, regions, and sensitive data.

The Securonix Threat Research team has identified an ongoing espionage campaign, tracked as SHEETCREEP, where threat actors deliver a C# remote access trojan through a diplomatic-themed ISO phishing lure.

Securonix Threat Research tracks TAX#TRIDENT, an active fake Indian Income Tax-themed campaign that uses three delivery paths to reach Windows endpoints. The campaign starts with fake tax assessment lures and then moves victims toward ZIP files, VBScript downloaders, or PHP-looking web endpoints that actually return script content.