The Evil MSI Background is Back!, (Fri, Jun 5th)
2026-06-06T13:23:46Z•6046c11a9712cd376c2b77362c15debc77f01c85e9761abe43b246a9c70e41f6
JPEGNetSupport RATRATSVGWeTransferapi-exposureimage-based-malwaremalicious-attachmentsmalware-distributionphishingsteganographyswagger.json scans
What happened
SANS ISC diaries report multiple active email-based campaigns abusing image formats and file-sharing links to deliver malware: a resurgence of an "MSI"-branded background payload hidden in a JPEG (delivered via a WeTransfer link), a new wave of phishing delivering malicious SVG files (image-only emails with no body links), and an unidentified RAT that drops NetSupport RAT. Separately, there are continued scans for swagger.json (exposed API surfaces). No specific CVEs are cited in the entries.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- 6046c11a9712cd376c2b77362c15debc77f01c85e9761abe43b246a9c70e41f6
- Enrichment time
- 2026-06-06T13:23:46Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.