The threat uses a multi-stage infection chain starting with a phishing email containing a WeTransfer link to a JavaScript file named "Remittance Advice.js". This script contains obfuscated code that sets an environment variable with a ROT13-obfuscated PowerShell command. The PowerShell command is executed via WMI to spawn a hidden process that downloads a malicious MSI-branded JPEG background image from a Cloudflare Workers subdomain. The image contains a Base64-encoded .NET DLL payload with modified encoding to evade detection. This DLL is a modified Microsoft.Win32.TaskScheduler library used to load and execute further payloads, including another image file hosted on Cloudflare R2 storage, likely containing a steganographically hidden payload. The attacker abuses legitimate cloud services to host payloads, increasing stealth and resilience. The attack technique is a resurgence of a previously observed method involving MSI-branded backgrounds.

The attack chain allows remote code execution via PowerShell and WMI, enabling the attacker to execute arbitrary code on the victim's system stealthily. The use of legitimate cloud services for payload hosting complicates detection and blocking. The malicious .NET DLL can manipulate Windows Task Scheduler, potentially enabling persistence or further malicious actions. Although no known exploits in the wild are reported, the technique's increasing popularity indicates a growing threat. The impact includes potential system compromise and unauthorized execution of attacker-controlled code.

No official patch or vendor advisory is available for this threat. Since the attack relies on social engineering via phishing emails and abuse of legitimate cloud services, mitigation should focus on user awareness and email filtering to detect suspicious WeTransfer links and JavaScript attachments. Endpoint protection solutions should be tuned to detect obfuscated PowerShell execution and anomalous WMI process creation. Network monitoring for unusual connections to Cloudflare Workers and R2 domains may help identify suspicious activity. Given the lack of a direct patch, organizations should apply layered defenses to detect and block this attack vector.