The Evil MSI Background is Back!, (Fri, Jun 5th)
2026-06-06T19:23:47Z•3089d04f40228e95e98860f102a6988516888f7e5d10fa7be497e08e437e06cc
API reconnaissanceJPEGMSINetSupport RATRATSVGWeTransferemail-deliverymalicious-imagemalware-deliveryphishingsteganographyswagger.json
What happened
SANS ISC reports multiple active email-delivered attack techniques: resurgence of MSI-branded backgrounds with payloads embedded into JPEGs (steganography), a surge in phishing emails delivering malicious SVG files, and an instance of an unidentified RAT dropping NetSupport RAT. Separately, scanners continue to probe for swagger.json endpoints (API surface discovery). No specific CVEs reported. Recommended focus: block/inspect suspicious image attachments (SVG/JPEG), monitor for NetSupport-related callbacks, restrict/monitor large-file services (WeTransfer), and tighten API exposure controls.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- 3089d04f40228e95e98860f102a6988516888f7e5d10fa7be497e08e437e06cc
- Enrichment time
- 2026-06-06T19:23:47Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.