SecuriTricks - steganography

ClickFix Gets Creative: Malware Buried in Images

A multi-stage malware execution chain originating from a ClickFix lure has been discovered, leading to the delivery of infostealing malware like LummaC2 and Rhadamanthys. The campaign utilizes steganography to hide malicious code within PNG images. Two distinct ClickFix lures were observed: a stand…

social engineering

lummac2

Published: November 24, 2025

Downloadable IOCs: 32

Sophisticated Tuoni C2 Attack on U.S. Real Estate Firm Thwarted

In October 2025, a major U.S. real estate company was targeted by a highly advanced cyberattack using the emerging Tuoni C2 framework. The attack, which showed signs of AI assistance in code generation, was neutralized by Morphisec's Automated Moving Target Defense (AMTD) technology. The campaign l…

Published: November 19, 2025

Downloadable IOCs: 4

Brazilian Caminho Loader Employs LSB Steganography and Fileless Execution to Deliver Multiple Malware Families Across South America, Africa, and Eastern Europe

A new malware loader called Caminho, originating from Brazil, has been identified using steganography to hide .NET payloads in image files hosted on legitimate platforms. Active since March 2025, the campaign has evolved significantly, delivering various malware types across South America, Africa, …

Published: October 22, 2025

Downloadable IOCs: 0

XWorm RAT Delivered via Shellcode: Multi-Stage Attack Analysis

This analysis details a sophisticated multi-stage attack delivering the XWorm RAT. The campaign begins with a phishing email containing a malicious .xlam file. The file harbors embedded shellcode that, when executed, retrieves a secondary payload. This payload is a .NET binary that reflectively loa…

reflective dll injection

2025-09-29

Published: September 29, 2025

Downloadable IOCs: 8

FileFix in the wild! New FileFix campaign goes beyond POC and leverages steganography

A sophisticated FileFix attack campaign has been discovered, marking the first use of this technique beyond proof-of-concept. The attack employs a complex phishing infrastructure, including a multilingual site mimicking Facebook security. It uses steganography to conceal malicious code in images, w…

Published: September 16, 2025

Downloadable IOCs: 17

Gh0st RAT-based GodRAT attacks financial organizations

A newly identified Remote Access Trojan named GodRAT, based on the Gh0st RAT codebase, has been targeting financial firms since September 2024. The attackers distribute malicious .scr files via Skype, using steganography to embed shellcode in images. GodRAT supports plugins and is used alongside br…

ms edge password stealer

godrat

chrome password stealer

Published: August 19, 2025

Downloadable IOCs: 0

AI brings back real trojan horse malware

Trojan horses, once rare, are making a resurgence due to AI and Large Language Models (LLMs). These new trojans, disguised as legitimate applications like recipe apps or AI-powered image search tools, are evading traditional security measures. They appear professional, pass VirusTotal scans, and ex…

Published: August 13, 2025

Downloadable IOCs: 0

RoKRAT Shellcode and Steganographic Threats: Analysis and EDR Response Strategies

A new variant of RoKRAT malware used by APT37 has been identified, employing a two-stage encrypted shellcode injection method and steganography to conceal malicious code in image files. The malware uses shortcut files with embedded commands to execute its attack, distributed via compressed archives…

Published: August 7, 2025

Downloadable IOCs: 0

Secret Message: Steganography Tricks of TA558 Group in Cyber Attacks on Enterprises in Russia and Belarus

F.A.C.C.T.'s Threat Intelligence analysts have investigated numerous cyberattacks by the TA558 group targeting enterprises, government institutions, and banks in Russia and Belarus. The attacks aimed to steal data and gain access to the organization's internal systems. TA558 used multi-stage phishi…

Published: July 30, 2024

Linked vulnerabilities : CVE-2017-11882

Downloadable IOCs: 74

To the Moon and back(doors): Lunar landing in diplomatic missions

ESET researchers discovered two previously unknown backdoors – LunarWeb and LunarMail – compromising a European ministry of foreign affairs and its diplomatic missions abroad. LunarWeb, deployed on servers, utilizes HTTP(S) for command and control communications, mimicking legitimate requests to av…

Published: May 16, 2024

Downloadable IOCs: 12

RemcosRAT Distributed Using Steganography

Security researchers have discovered a campaign distributing RemcosRAT through a sophisticated infection chain involving steganography techniques. The attack starts with a malicious Word document exploiting template injection, leading to the download of an RTF file that leverages an equation editor…

Published: May 8, 2024

Downloadable IOCs: 4

Tag: steganography

Attack reports

ClickFix Gets Creative: Malware Buried in Images

Sophisticated Tuoni C2 Attack on U.S. Real Estate Firm Thwarted

Brazilian Caminho Loader Employs LSB Steganography and Fileless Execution to Deliver Multiple Malware Families Across South America, Africa, and Eastern Europe

XWorm RAT Delivered via Shellcode: Multi-Stage Attack Analysis

FileFix in the wild! New FileFix campaign goes beyond POC and leverages steganography

Gh0st RAT-based GodRAT attacks financial organizations

AI brings back real trojan horse malware

RoKRAT Shellcode and Steganographic Threats: Analysis and EDR Response Strategies

Likely Belarus-Nexus Threat Actor Delivers Downloader to Poland

DCRAT Impersonating the Colombian Government

More Steganography!

Stealthy .NET Malware: Hiding Malicious Payloads as Bitmap Resources

Steganography Analysis With pngdump.py

Operation Sea Elephant: The Dying Walrus Wandering the Indian Ocean

New Steganographic Campaign Distributing Multiple Malware Variants

Formbook Phishing Campaign with old Payloads

The Mobile Malware Chronicles: Necro.N - Volume 101

The Dark Knight Returns: Joker malware analysis

Advanced Persistent Threat Targeting Vietnamese Human Rights Defenders

Secret Message: Steganography Tricks of TA558 Group in Cyber Attacks on Enterprises in Russia and Belarus

To the Moon and back(doors): Lunar landing in diplomatic missions

RemcosRAT Distributed Using Steganography