Environment Variables Hide What Static Scanners Miss
The risky part is not the JavaScript file itself. The script drops the real next stage into an environment variable, then hands that variable to PowerShell through WMI, so a file-hash check or static scan can look clean even when the code that runs is not. That gives the attacker a place to stage payloads outside the attachment and outside the normal file view.
SANS ISC found that pattern in a WeTransfer-delivered sample called "Remittance Advice.js." The file carried junk code, then decoded an environment-variable payload named INTERNAL_DB_CACHE, used hidden PowerShell, and extended an earlier hiding pattern that had embedded payloads in a JPEG and an MSI-branded background. The chained use of obfuscation, env-var staging, and stego-protected content is built to evade tools that only inspect the initial script or its hash.
That leaves email and Windows defenders with a blind spot at runtime, not just at delivery.