That innocent “sysupdate.jpeg” file sitting in your downloads folder? It might be a PowerShell script in disguise. Cybersecurity researchers at Cyfirma have uncovered Operation SilentCanvas, a sophisticated campaign where attackers weaponize fake JPEG files to deploy trojanized remote access tools on Windows systems. These malicious files lack proper JPEG headers but slip past basic security checks, exploiting the trust you place in common image formats.
Multi-Stage Attack Chain Bypasses Standard Defenses
The malware creates hidden folders and downloads additional payloads through encrypted channels.
Once executed, the disguised PowerShell script establishes a C:\Systems folder and downloads a trojanized ScreenConnect package from legitserver.theworkpc[.]com via TCP port 5443. The attack doesn’t stop there—it fetches a secondary “access.jpeg” payload that runs entirely in memory, evading disk-based antivirus scans. Most cleverly, it hijacks the ms-settings registry key to trigger ComputerDefaults.exe, achieving silent UAC bypass and administrative privileges before the key self-destructs within two seconds.
Complete System Takeover Through Legitimate Tool Abuse
Attackers gain screen monitoring, keylogging, and file theft capabilities once installed.
The trojanized ScreenConnect, deployed to C:\ProgramData\OneDriveServer\, transforms your PC into a surveillance station. Attackers can:
- Monitor your screen
- Capture keystrokes
- Access your microphone and camera
- Steal clipboard contents
- Exfiltrate files through encrypted channels
The malware establishes persistent access via an “OneDriveServers” service, ensuring it survives reboots and continues operating in the background.
Phishing Emails Deliver Fake Government Notices
Social Security Administration impersonation and fake software updates serve as common delivery methods.
These weaponized files typically arrive through phishing emails masquerading as Social Security Administration notices or software update notifications. The campaign connects to broader trends like ClickFix, which uses steganography to hide shellcode inside PNG files on fake Windows Update pages. “The campaign does not rely on a single trick but chains together multiple advanced techniques,” according to Cyfirma researchers, making detection significantly more challenging than traditional malware.
Defense Requires Behavioral Monitoring and Access Controls
Blocking specific system binaries and monitoring PowerShell activity provides essential protection.
Your best defense involves:
- Blocking abuse of legitimate Windows binaries like csc.exe and ComputerDefaults.exe through application whitelisting
- Enabling PowerShell logging and monitoring for suspicious script execution, especially from unexpected file types
- Restricting or closely monitoring remote management tools like ScreenConnect in your environment
If you suspect exposure, immediately reset all stored credentials and scan for the telltale C:\Systems and C:\ProgramData\OneDriveServer directories.
