Do Son Researchers expose PixyNetLoader malware analysis revealing APT28's steganography APT28 attack, hiding Covenant Grunt payloads inside PNG pixels since 2024.
steganography
A sneaky Steam profile malware campaign targets WordPress. Attackers use invisible Unicode steganography to hide malicious command strings.
Trellix uncovers PureRAT, a modular Trojan hiding malware in PNG images. Learn how it uses steganography and fileless delivery to bypass Windows security.
Pawn Storm (APT28) debuts the PRISMEX suite, weaponizing Office zero-days against NATO logistics. Discover the stealth tactics behind this 2026 offensive.
Aryaka Threat Labs exposes BlackSanta, a Russian-linked malware targeting HR teams with fake resumes to deploy an EDR-killer and steal crypto wallets.
ClearSky uncovers a Russian campaign targeting Ukraine with BadPaw and MeowMeow malware, using steganography and feline decoys for stealthy espionage.
Socket uncovers "StegaBin," a North Korean malware campaign hiding C2 URLs in Pastebin essays to steal developer secrets via 26 typosquatted npm packages.
OysterLoader malware uses custom LZMA & steganography to evade tools. Linked to Rhysida ransomware, it hides in fake IT installers.
Phishing emails use malicious Excel files to deploy XWorm RAT. The fileless attack exploits CVE-2018-0802 to steal data & control systems.
New Fake CAPTCHA campaign uses Google Calendar & steganography to drop Amatera Stealer. See how this attack exploits legitimate Windows tools to stay hidden.
New PURELOGS campaign uses Archive.org images to hide malware. For just $150, this MaaS steals crypto & passwords via fileless attacks. Spot the signs.
New fileless Remcos RAT campaign uses a "[virus detected]" shipping lure to inject malware into memory via process hollowing. See how to spot it.
Cyble reveals a unified commodity loader targeting Europe & Middle East. It uses steganography and a unique UAC bypass to deploy multiple RATs.
A notorious cyber-espionage group known for terrorizing South American institutions has launched a new campaign against the...
19 malicious VS Code extensions bypassed detection by hiding a Rust trojan in tampered node_modules and a fake banner.png using steganography. The attack uses cmstp.exe (LOLBIN) for execution.
Darktrace exposed Xillen Stealer v4/v5, a new MaaS threat using Rust polymorphism and an AIEvasionEngine to target 100+ browsers and Kubernetes/DevOps secrets. It uses steganography for exfiltration.
K7 Labs exposed a Python malware using multi-layer encoding (Base64/BZ2/Zlib) and a PNG-disguised RAR archive. The payload executes in memory and achieves stealth by injecting into cvtres.exe.
Splunk uncovered a new .NET steganographic loader that hides LokiBot malware inside embedded BMP and PNG image files. The multi-stage loader uses a separate container module, evading static detection.
Wordfence exposed a Magecart campaign using a rogue WooCommerce plugin to hide skimmer code in a fake PNG image. The malware uses an AJAX backdoor to maintain access and steal customer cards.
Unit 42 exposed PhantomVAI Loader, a stealthy MaaS tool that uses steganography (hiding DLL in images) and VM detection to deploy Katz Stealer in MSBuild.exe and exfiltrate crypto credentials globally.
McAfee uncovered the Astaroth banking Trojan using GitHub for C2 backup, hiding encrypted configuration data via steganography in images to target Brazilian financial and crypto users.
A new, advanced FileFix attack campaign uses social engineering and steganography to hide malware in images, bypassing traditional security defenses.