Do Son Splunk uncovered a new .NET steganographic loader that hides LokiBot malware inside embedded BMP and PNG image files. The multi-stage loader uses a separate container module, evading static detection.
.NET Loader
ASEC uncovers XwormRAT delivered via phishing emails using steganography, hiding sophisticated .NET malware within JPG images for stealthy execution and full system control.