The Evil MSI Background is Back!, (Fri, Jun 5th)
2026-06-05T19:23:47Z•014830c52440a0075e9c19c57c23d8e1c67e3d1a12c71801b4d6e138e18fb42c
NetSupport RATRATWeTransferapi-discoveryemail-attachmentsimage-embedded payloadjpegmalwarephishingremote access trojanscanningsteganographysvgswagger.jsonthreat-actor activity
What happened
SANS ISC diary (early June 2026) documents several active email-based threats and scanning activity: a resurgence of an image-embedded payload technique (MSI-branded background hidden in a JPEG)—observed delivered via email with a WeTransfer link; a spike in phishing emails delivering SVG files used to carry malicious content; continued automated scans looking for swagger.json (exposed API descriptors); and an unidentified RAT that has been observed dropping/pushing NetSupport RAT. No specific CVE references were provided. The activity indicates increased use of image/vector-based malicious st
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- 014830c52440a0075e9c19c57c23d8e1c67e3d1a12c71801b4d6e138e18fb42c
- Enrichment time
- 2026-06-05T19:23:47Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.