# Evil MSI background attack chain resurfaces via JavaScript

Published: 2026-06-05 · Severity: routine
Canonical: https://vorant.io/reports/2dfcce95-8e00-5cea-ae59-a3b9620fbdce/evil-msi-background-attack-chain-resurfaces-via-javascript

> JavaScript payload delivers obfuscated PowerShell that loads malicious .NET DLL via Cloudflare workers and R2 storage.

A multi-stage attack chain has been observed distributing malware through JavaScript files disguised as innocuous content and delivered via WeTransfer. The initial JavaScript file ("Remittance Advice.js") contains obfuscated code that uses ROT13 encoding to hide a PowerShell command executed via WMI. The PowerShell fetches an MSI background JPEG from a Cloudflare Workers endpoint, which contains a steganographically-hidden Base64-encoded .NET DLL (modified Microsoft.Win32.TaskScheduler library). The DLL then fetches a secondary payload from Cloudflare R2 storage. This represents an evolution of a previously documented technique that embeds payloads into JPEG images. The attack leverages legitimate cloud services (Cloudflare Workers and R2) and obfuscation techniques including ROT13 encoding and Base64 with character substitution to evade simple detection.

## Mentioned in this report

- Malware: Evil MSI Background loader

## Detection guidance (public sample)

### WMI Provider Host Spawning PowerShell With Download Cradle

ATT&CK: T1047

WmiPrvSE.exe spawning PowerShell that downloads content or decodes Base64, as when a script launches a PowerShell stager through WMI. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: WMI Provider Host Spawning PowerShell With Download Cradle
description: Detects powershell.exe launched by WmiPrvSE.exe (WMI Win32_Process Create)
  whose command line contains a web download cradle or Base64 decoding. Matches script-driven
  WMI execution of a PowerShell stager, not a specific URL or filename.
tags:
- attack.execution
- attack.t1047
- attack.t1059.001
- attack.t1140
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \WmiPrvSE.exe
  selection_child:
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
  selection_cmd:
    CommandLine|contains:
    - Invoke-WebRequest
    - Invoke-RestMethod
    - DownloadString
    - DownloadData
    - DownloadFile
    - Net.WebClient
    - Start-BitsTransfer
    - FromBase64String
    - 'iwr '
    - 'irm '
  condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Remote management or inventory tooling that runs PowerShell download commands through
  WMI
- Admins running remote WMI process creation for software deployment
level: high
id: 9ab8bfe9-7ae8-5a83-8b48-848d1c1c3a4e
status: experimental
author: Vorant
references:
- https://isc.sans.edu/diary/rss/33054
```

### PowerShell Downloading Image And Loading Embedded Assembly

ATT&CK: T1027

PowerShell command line combining an image download, Base64 decoding and in-memory .NET assembly loading, indicating payload hidden inside an image. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: PowerShell Downloading Image And Loading Embedded Assembly
description: Detects PowerShell command lines that combine a web download, an image
  file extension, and Base64 decoding or reflective assembly loading. This pattern
  fits steganographic payload delivery, where a .NET DLL is hidden in a JPEG/PNG and
  loaded in memory.
tags:
- attack.stealth
- attack.t1027
- attack.t1027.010
- attack.t1140
- attack.t1059.001
- attack.t1106
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
  selection_download:
    CommandLine|contains:
    - Invoke-WebRequest
    - Invoke-RestMethod
    - DownloadString
    - DownloadData
    - DownloadFile
    - Net.WebClient
    - 'iwr '
  selection_image:
    CommandLine|contains:
    - .jpg
    - .jpeg
    - .png
    - .bmp
  selection_decode_load:
    CommandLine|contains:
    - FromBase64String
    - Reflection.Assembly
    - '[System.AppDomain]'
    - Assembly]::Load
  condition: selection_img and selection_download and selection_image and selection_decode_load
falsepositives:
- Administrative scripts that download images and encode them as Base64 for web or
  reporting use
level: high
id: 237ff6c5-dc11-5022-90db-b1d4f3fd6dff
status: experimental
author: Vorant
references:
- https://isc.sans.edu/diary/rss/33054
```

### Windows Script Host Running JavaScript From Download Or Temp Location

ATT&CK: T1059.001

wscript or cscript executing a .js file from a download, temp or archive-extraction path, as in a JavaScript lure delivered through file-sharing links. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Windows Script Host Running JavaScript From Download Or Temp Location
description: Detects wscript.exe or cscript.exe executing a .js or .jse file from
  user download, temp or archive-extraction locations. This is the usual execution
  path for JavaScript lures delivered through phishing links or cloud file-sharing,
  which then launch PowerShell stagers.
tags:
- attack.execution
- attack.t1059.007
- attack.t1566.002
- attack.t1566.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
    - \wscript.exe
    - \cscript.exe
  selection_ext:
    CommandLine|contains:
    - .js
    - .jse
  selection_path:
    CommandLine|contains:
    - \Downloads\
    - \AppData\Local\Temp\
    - \Temp\Rar$
    - \Temp\7z
    - .zip\
  condition: selection_img and selection_ext and selection_path
falsepositives:
- Users or admins manually running downloaded JavaScript utilities
- Software installers that run bundled .js helpers from a temp directory
level: medium
id: dd6d964c-f1bd-57ef-825b-1734dd953a6d
status: experimental
author: Vorant
references:
- https://isc.sans.edu/diary/rss/33054
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

3 more detections for this report are in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://isc.sans.edu/diary/rss/33054

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/2dfcce95-8e00-5cea-ae59-a3b9620fbdce/evil-msi-background-attack-chain-resurfaces-via-javascript.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup