Continuing Scans for swagger.json, (Wed, Jun 3rd)

SANS ISC diary items (late May–early June 2026) report multiple active observations: continued automated scans probing for swagger.json (exposed API specs / reconnaissance), a new phishing wave delivering malicious SVG files (no visible URLs, image-only delivery), an observed unidentified RAT that subsequently drops NetSupport RAT, a YARA‑X 1.17.0 release (performance improvements + bugfix), and a DShield one‑year file upload analysis showing seasonal peaks in malicious file submissions. Combined, these indicate active reconnaissance and commodity-malware distribution (phishing + RATs) with an