Threat Brief — 2026-08-31 — SVG smuggling, RDP RCE update, DPRK job fraud pivots

Executive summary: A practical SVG-based email smuggling technique is bypassing standard Microsoft filtering at a 75% rate, reaching corporate inboxes directly. Microsoft has updated acknowledgement of a Remote Desktop Client RCE vulnerability (CVE-2026-59134), though details remain sparse. DPRK-linked job-fraud operations have expanded beyond IT roles into healthcare and sales sectors, broadening the infiltration surface. The Cronos blockchain has resumed operations following the $74M Tectonic protocol exploit.

Top items

• CVE-2026-59134 — Remote Desktop Client RCE, acknowledgement updated. Microsoft has updated the acknowledgement for this Remote Desktop Client remote code execution vulnerability. The advisory provides no further detail beyond the acknowledgement change, so the current exploitation status and affected versions are unclear from the available information. Given that RDP client-side RCE can be triggered by a malicious server or crafted RDP file, this warrants monitoring for additional details. (src: MSRC)

• SVG smuggling technique bypasses Microsoft email protection at 75% rate. Researchers demonstrated an email attack technique using SVG attachments to smuggle malicious payloads past standard corporate email filters — approximately three-quarters of test messages reached inboxes. SVG files are often treated as benign images by filtering gateways but can carry embedded scripts and obfuscated payloads. This is a practical, replicable technique that depends on email gateway configuration rather than a specific product vulnerability. (src: SecurityLab)

• DPRK job-fraud operations expand beyond IT into healthcare and sales. Threat actors tied to the DPRK have been observed seeking employment in healthcare and sales roles, not just IT positions. This broadens the sectors where insider-placement operations may occur and suggests the campaign is adapting to scrutiny focused on IT hiring pipelines. (src: The Hacker News)

• Cronos blockchain resumes after $74M Tectonic exploit. The Cronos network has restarted trading activity following a price-manipulation attack on the Tectonic lending platform that allowed an attacker to borrow $74 million. The network was initially halted on 2026-08-31 (first reported by Xakep); the restart is the first material development since. (src: BleepingComputer)

Themes

Social engineering surface widens. Both the SVG smuggling technique and the DPRK job-fraud expansion illustrate attackers shifting to abuse legitimate channels — email attachments and hiring processes — rather than exploiting software flaws. Defence here depends on gateway configuration, hiring vetting, and user awareness rather than patching.