The Evil MSI Background is Back!, (Fri, Jun 5th)

SANS ISC observed multiple active campaigns and techniques: a resurgence of payloads embedded inside images (an MSI-branded payload hidden in a JPEG delivered via a WeTransfer link), a new wave of phishing that uses SVG file attachments to deliver malicious content, continued automated scans for swagger.json (discovery/exposure of API endpoints), and an instance of an unidentified RAT deploying NetSupport RAT. These are being used to deliver remote-access malware and likely enable persistence, credential theft, and lateral movement. No specific CVEs were mentioned in the reports.