The Evil MSI Background is Back!, (Fri, Jun 5th)
2026-06-05T13:23:49Z•4544db5c54350c1a8d2ff01207bdf3112494f939dbfaab0d656b44921920e2b8
JPEG-embedded-payloadMSI-backgroundNetSupport-RATRATSANS-ISCSOAPSVG-attachmentsWeTransferapi-exposuremalware-steganographyphishingreconnaissanceswagger.jsonthreat-trends
What happened
SANS ISC diaries (June 1–5, 2026) describe an uptick in mail-based malware delivery techniques and reconnaissance activity. Notable items: a resurgence of an 'MSI-branded' background payload embedded in JPEGs (distributed via WeTransfer); a new wave of phishing messages delivering SVG files (used to hide/deliver malicious content); an unidentified RAT observed dropping NetSupport RAT; and continued scanning for swagger.json endpoints (indicating reconnaissance/exposed API surfaces). Other entries include commentary on SOAP/web-services complexity and a note about CoreUtils for Windows. No CVEs
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- 4544db5c54350c1a8d2ff01207bdf3112494f939dbfaab0d656b44921920e2b8
- Enrichment time
- 2026-06-05T13:23:49Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.