Evil MSI background attack chain resurfaces via JavaScript

5 June 2026 routine threat

Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.

JavaScript payload delivers obfuscated PowerShell that loads malicious .NET DLL via Cloudflare workers and R2 storage.

A multi-stage attack chain has been observed distributing malware through JavaScript files disguised as innocuous content and delivered via WeTransfer. The initial JavaScript file ("Remittance Advice.js") contains obfuscated code that uses ROT13 encoding to hide a PowerShell command executed via WMI. The PowerShell fetches an MSI background JPEG from a Cloudflare Workers endpoint, which contains a steganographically-hidden Base64-encoded .NET DLL (modified Microsoft.Win32.TaskScheduler library). The DLL then fetches a secondary payload from Cloudflare R2 storage. This represents an evolution of a previously documented technique that embeds payloads into JPEG images. The attack leverages legitimate cloud services (Cloudflare Workers and R2) and obfuscation techniques including ROT13 encoding and Base64 with character substitution to evade simple detection.

Mentioned in this report

Malware Evil MSI Background loader

Detection guidance

WMI Provider Host Spawning PowerShell With Download Cradle

ATT&CK T1047

WmiPrvSE.exe spawning PowerShell that downloads content or decodes Base64, as when a script launches a PowerShell stager through WMI. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: WMI Provider Host Spawning PowerShell With Download Cradle
description: Detects powershell.exe launched by WmiPrvSE.exe (WMI Win32_Process Create)
  whose command line contains a web download cradle or Base64 decoding. Matches script-driven
  WMI execution of a PowerShell stager, not a specific URL or filename.
tags:
- attack.execution
- attack.t1047
- attack.t1059.001
- attack.t1140
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \WmiPrvSE.exe
  selection_child:
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
  selection_cmd:
    CommandLine|contains:
    - Invoke-WebRequest
    - Invoke-RestMethod
    - DownloadString
    - DownloadData
    - DownloadFile
    - Net.WebClient
    - Start-BitsTransfer
    - FromBase64String
    - 'iwr '
    - 'irm '
  condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Remote management or inventory tooling that runs PowerShell download commands through
  WMI
- Admins running remote WMI process creation for software deployment
level: high
id: 9ab8bfe9-7ae8-5a83-8b48-848d1c1c3a4e
status: experimental
author: Vorant
references:
- https://isc.sans.edu/diary/rss/33054

PowerShell Downloading Image And Loading Embedded Assembly

ATT&CK T1027

PowerShell command line combining an image download, Base64 decoding and in-memory .NET assembly loading, indicating payload hidden inside an image. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: PowerShell Downloading Image And Loading Embedded Assembly
description: Detects PowerShell command lines that combine a web download, an image
  file extension, and Base64 decoding or reflective assembly loading. This pattern
  fits steganographic payload delivery, where a .NET DLL is hidden in a JPEG/PNG and
  loaded in memory.
tags:
- attack.stealth
- attack.t1027
- attack.t1027.010
- attack.t1140
- attack.t1059.001
- attack.t1106
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
  selection_download:
    CommandLine|contains:
    - Invoke-WebRequest
    - Invoke-RestMethod
    - DownloadString
    - DownloadData
    - DownloadFile
    - Net.WebClient
    - 'iwr '
  selection_image:
    CommandLine|contains:
    - .jpg
    - .jpeg
    - .png
    - .bmp
  selection_decode_load:
    CommandLine|contains:
    - FromBase64String
    - Reflection.Assembly
    - '[System.AppDomain]'
    - Assembly]::Load
  condition: selection_img and selection_download and selection_image and selection_decode_load
falsepositives:
- Administrative scripts that download images and encode them as Base64 for web or
  reporting use
level: high
id: 237ff6c5-dc11-5022-90db-b1d4f3fd6dff
status: experimental
author: Vorant
references:
- https://isc.sans.edu/diary/rss/33054

Windows Script Host Running JavaScript From Download Or Temp Location

ATT&CK T1059.001

wscript or cscript executing a .js file from a download, temp or archive-extraction path, as in a JavaScript lure delivered through file-sharing links. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Windows Script Host Running JavaScript From Download Or Temp Location
description: Detects wscript.exe or cscript.exe executing a .js or .jse file from
  user download, temp or archive-extraction locations. This is the usual execution
  path for JavaScript lures delivered through phishing links or cloud file-sharing,
  which then launch PowerShell stagers.
tags:
- attack.execution
- attack.t1059.007
- attack.t1566.002
- attack.t1566.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
    - \wscript.exe
    - \cscript.exe
  selection_ext:
    CommandLine|contains:
    - .js
    - .jse
  selection_path:
    CommandLine|contains:
    - \Downloads\
    - \AppData\Local\Temp\
    - \Temp\Rar$
    - \Temp\7z
    - .zip\
  condition: selection_img and selection_ext and selection_path
falsepositives:
- Users or admins manually running downloaded JavaScript utilities
- Software installers that run bundled .js helpers from a temp directory
level: medium
id: dd6d964c-f1bd-57ef-825b-1734dd953a6d
status: experimental
author: Vorant
references:
- https://isc.sans.edu/diary/rss/33054

3 more detections for this report are in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://isc.sans.edu/diary/rss/33054

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.

It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.

Create a free account What it costs