MSI-Branded Image Steganography: Analysis of WeTransfer Phishing

Overview of the MSI Steganography Campaign

A recurring threat has resurfaced involving the use of malicious image files to distribute payloads. According to SANS Internet Storm Center (ISC), security researchers have observed a resurgence of a TTP where malicious scripts are embedded within legitimate-looking MSI-branded JPEG images. This method utilizes steganography to hide data, effectively bypassing many traditional security controls that do not inspect the internal structure of common image formats.

In this recent campaign, the attack chain begins with a Phishing email that directs the recipient to a WeTransfer link. This technique leverages the reputation of a legitimate file-sharing service to circumvent email filters that might otherwise block direct attachments. Once the user downloads and opens the content, the stage is set for the execution of an embedded payload hidden within the image file.

Technical Analysis: How Steganography in JPEG Files is Weaponized

The core of this threat lies in the manipulation of the JPEG file structure. A standard JPEG file starts with the Start of Image (SOI) marker (FF D8) and ends with the End of Image (EOI) marker (FF D9). Image viewers typically stop processing data once they reach the EOI marker. However, attackers can append additional data, such as encrypted shellcode or obfuscated scripts, after the EOI marker. Because the file still displays a valid image when opened in a viewer, it appears benign to the end user and many basic antivirus scanners.

This specific campaign uses MSI-branded imagery (Micro-Star International) as a lure. This branding is likely chosen to target users who might expect drivers, firmware updates, or gaming-related software, increasing the likelihood of the user following through with the download. A primary challenge for the SOC is that these files do not exhibit the high entropy typically associated with packed or encrypted executables because the majority of the file remains legitimate image data.

Analysis of Phishing Campaigns Using WeTransfer Links

The reliance on external file-sharing platforms like WeTransfer indicates a shift away from direct attachments. By hosting the malicious MSI-branded background image on a trusted third-party service, attackers reduce the footprint of their initial email. This makes it difficult for a SIEM to flag the email based on the attachment alone. The URL itself points to a legitimate domain, further complicating detection.

Once the victim downloads the file, a secondary loader—often a PowerShell script or a native Windows binary (Living-off-the-Land)—is required to extract and execute the hidden payload. This extraction process is often mapped to the MITRE ATT&CK framework under the Obfuscated Files or Information technique (T1027). If the extraction tool is already present on the system, the risk of EDR detection is minimized until the payload attempts to establish a connection to a C2 server.

Detection and Forensic Analysis

Security professionals must understand how to detect steganography in JPEG files to counter this threat. Traditional hash-based IoC tracking is often ineffective as the attacker can slightly modify the image to change the hash without affecting the payload. Instead, defenders should focus on file integrity and structural analysis. Tools that calculate the “offset” of the EOI marker compared to the total file size can identify appended data. If a JPEG file continues significantly beyond the FF D9 marker, it should be treated as suspicious.

Furthermore, monitoring for unusual child processes spawning from common image viewing applications or browsers is essential. For instance, if PowerShell.exe or Cmd.exe is initiated shortly after a user accesses a file from a file-sharing site, it may indicate that a loader is attempting to pull the payload from the image.

Defensive Recommendations

To mitigate the risk of a malicious MSI-branded background image or similar steganographic threats, organizations should implement the following measures:

• Link Inspection: Configure email security gateways to scrutinize links to file-sharing services. Implement “Time-of-Click” protection to re-evaluate URLs each time they are accessed.
• File Analysis: Use advanced sandbox environments that can perform deep file inspection, looking for data appended to the EOF (End of File) in non-executable formats.
• Endpoint Hardening: Restrict the execution of scripts (e.g., PowerShell, VBScript) for standard users. Implementing constrained language mode can prevent many loaders from successfully extracting the hidden payload.
• User Awareness: Educate staff on the risks of phishing campaigns using WeTransfer links, emphasizing that even legitimate platforms can be abused to host malicious content.