Evil MSI Background Steganography Campaign

A recently identified campaign utilizes official WeTransfer links to deliver a heavily obfuscated JavaScript file named 'Remittance Advice.js'. This initial stage decodes a ROT13-obfuscated PowerShell command that is executed via WMI to bypass traditional process monitoring and maintain a low profile.

The attack chain leverages Cloudflare Workers and R2 storage to host malicious assets, including a JPEG file containing a hidden .NET payload. This payload is a modified version of the Microsoft.Win32.TaskScheduler library, which is likely used for persistence or lateral movement. This campaign is notable for its use of steganography (hiding data in images) and its reliance on legitimate cloud services to evade reputation-based filtering.