Steganographic Malware Detection — Complete Documentation & Simulation

Overview & System Context

Steganographic Malware Detection: Comprehensive Web-Sourced Technical Investigation Exhaustive Research Dossier · Pure Web-Scraped Content: ~8523 Words · Real Software Screenshots: 3 1. Executive Overview & Technical Background Steganography ( , STEG-I-NOG-rI-fee) is the practice of representing information within another message or physical object, in such a manner that the presence of the concealed information would not be evident to an unsuspecting person's examination. In computing and electronic contexts, a computer file, message, image, or video is concealed within another file, message, image, or video. Generally, the hidden messages appear to be (or to be part of) something else: images, articles, shopping lists, or some other cover text. For example, the hidden message may be in invisible ink between the visible lines of a private letter. Some implementations of steganography that lack a formal shared secret are forms of security through obscurity, while key-dependent steganographic schemes try to adhere to Kerckhoffs's principle. The word steganography comes from Greek steganographia, which combines the words steganós (στεγανIς), meaning "covered or concealed", and -graphia (γραφI) meaning "writing". The first recorded use of the term was in 1499 by Johannes Trithemius in his Steganographia, a treatise on cryptography and steganography, disguised as a book on magic. The advantage of steganography over cryptography alone is that the intended secret message does not attract attention to itself as an object of scrutiny. Plainly visible encrypted messages, no matter how unbreakable they are, arouse interest and may in themselves be incriminating in countries in which encryption is illegal. Whereas cryptography is the practice of protecting the contents of a message alone, steganography is concerned with concealing both the fact that a secret message is being sent and its contents. Steganography includes the concealment of information within computer files. In digital steganography, electronic communications may include steganographic coding inside a transport layer, such as a document file, image file, program, or protocol. Media files are ideal for steganographic transmission because of their large size. For example, a sender might start with an innocuous image file and adjust the color of every hundredth pixel to correspond to a letter in the alphabet. The change is so subtle that someone who is not looking for it is unlikely to notice the change.

The first recorded uses of steganography can be traced back to 440 BC in Greece, when Herodotus mentions two examples in his Histories. Histiaeus sent a message to his vassal, Aristagoras, by shaving the head of his most trusted servant, "marking" the message onto his scalp, then sending him on his way once his hair had regrown, with the instruction, "When thou art come to Miletus, bid Aristagoras shave thy head, and look thereon." Additionally, Demaratus sent a warning about a forthcoming attack to Greece by writing it directly on the wooden backing of a wax tablet before applying its beeswax surface.

Wax tablets were in common use then as reusable writing surfaces, sometimes used for shorthand. Greek writer Aeneas Tacticus also devised a method of steganography now known as the pinhole cipher. He tells of a method where you are to write a letter and mark specific characters inside the letter with a dot-shaped hole. The recipient of said letter will simply note down all letters below the holes and string them together to form a message. He also suggested writing down a message and whitening it, making it invisible, so that when soaked in water the message would be revealed. He suggests many other hiding methods, such as hiding a message in leaves, in the foot of a messenger's sandal, and even in animal bladders. In his Compendium of Mechanics, Philo of Byzantium describes a recipe for invisible ink. He says to write down a message with crushed gallnuts dissolved in water. Then it could be revealed by being soaked by a sponge of ferrous sulfate. This recipe was inspired by the recipe for gall ink. Ferrous sulfate and crushed gallnuts dissolved in water both react to make ink so when they combine the message is revealed. In his Ars Amatoria, Roman poet Ovid noted of a primitive form of invisible ink using milk to be used in writing love letters. Naturalist Pliny the Elder also wrote of the tithymalus plant in his Natural History, and how its milk could be used for invisible ink. The first recorded use of the term steganography was by Johannnes Trithemius with his Steganographia, a book seemingly about summoning angels to hide messages. In reality however, the book was about steganography, the angel summoning being a cover text. Every angel corresponded to a different method of steganography.

He had written a letter to Arnold Bostius about his book, how it contained many methods of secret writing, how it could be used to communicate without speaking, signing or even nodding and much more. Bostius had died before he could receive the letter, however his colleagues had read and published it, accusing him of conversing with demons. Trithemius had also invited Charles de Bovelles to read his book before de Bovelles threw it away, claiming Trithemius was a magician. This situation led Trithemius to quit the book, not however, his interest in steganography. In his work Polygraphiae, Trithemius developed his Ave Maria cipher, a polyalphabetic substitution cipher and form of steganography that can hide information in a Latin praise of God. It consists of around 384 alphabets of 24 letters corresponding to 24 words to praise God. To encode a message, take the first letter of your message and replace that letter with the corresponding word in the first alphabet. Do that for the second, the third, and so on. "Conservator magnus conservans cuncta iuftis fuis in felicitatibus amen", for example, contains the concealed word SECRET. In the year 1606, Book I and II of the Steganographia were printed in Frankfurt, along with an incomplete Book III, and the Clavis Steganographie. The Clavis explained how to extract the secret of the Steganographia from Book I and II. Simply select an incantation to summon an "angel" and extract every other letter of every other word to find the secret steganographic method associated with that angel. With this publication came a slew of books vindicating Trithemius by explaining the steganography, acquitting him of magic. However, Book III was still widely regarded as a work of magic, with no clear way to extract its secrets. It would take until the late 1990s when Jim Reeds and Thomas Ernst independently discovered that it too, was secretly a work of steganography.

Numerous techniques throughout history have been developed to embed a message within another medium. Hiding a message in the title and context of a shared video or image. Misspelling names or words that are popular in the media in a given week, to suggest an alternative meaning. Hiding a picture that can be traced by using Paint or any other drawing tool.

Figure 1: Multi-Stage Steganographic Loader Deploys Remcos RAT and Multiple ... Since the dawn of computers, techniques have been developed to embed messages in digital cover mediums. The message to conceal is often encrypted, then used to overwrite part of a much larger block of encrypted data or a block of random data (an unbreakable cipher like the one-time pad generates ciphertexts that look perfectly random without the private key).

Examples of this include changing pixels in image or sound files, properties of digital text such as spacing and font choice, chaffing and winnowing, mimic functions, modifying the echo of a sound file (echo steganography), and including data in ignored sections of a file. Although not classic steganography, some types of modern color laser printers integrate the model, serial number, and timestamps on each printout for traceability reasons using a dot-matrix code made of small, yellow dots not recognizable to the naked eye (see: Printer tracking dots, for details).

Steganophony – the concealment of messages in Voice-over-IP conversations, e.g. the employment of delayed or corrupted packets that would normally be ignored by the receiver (this method is called LACK – Lost Audio Packets Steganography), or, alternatively, hiding information in unused header fields. WLAN Steganography – transmission of steganograms in Wireless Local Area Networks. A practical example of WLAN Steganography is the HICCUPS system (Hidden Communication System for Corrupted Networks) Discussions of steganography generally use terminology analogous to and consistent with conventional radio and communications technology. However, some terms appear specifically in software and are easily confused. These are the most relevant ones to digital steganographic systems: The payload is the data covertly communicated. The carrier is the signal, stream, or data file that hides the payload, which differs from the channel, which typically means the type of input, such as a JPEG image. The resulting signal, stream, or data file with the encoded payload is sometimes called the package, stego file, or covert message. The proportion of bytes, samples, or other signal elements modified to encode the payload is called the encoding density and is typically expressed as a number between 0 and 1. In a set of files, the files that are considered likely to contain a payload are suspects. A suspect identified through some type of statistical analysis can be referred to as a candidate.

Figure 2: VSL: Virtual Steganographic Laboratory download for Windows Some modern computer printers use steganography, including Hewlett-Packard and Xerox brand color laser printers. The printers add tiny yellow dots to each page. The barely visible dots contain encoded printer serial numbers and date and time stamps. The Electronic Frontier Foundation confirmed the marks are a forensic tracking tool, reportedly part of a secret agreement between printer manufacturers and governments to help track counterfeiters.

It is possible to steganographically hide computer malware into digital images, videos, audio and various other files in order to evade detection by antivirus software. This type of malware is called stegomalware. It can be activated by external code, which can be malicious or even non-malicious if some vulnerability in the software reading the file is exploited. Stegomalware can be removed from certain files without knowing whether they contain stegomalware or not. This is done through content disarm and reconstruction (CDR) software, and it involves reprocessing the entire file or removing parts from it. Various methods can be employed within CDR software to counter stegomalware with varying levels of mitigation relative to visual integrity disruption. Actually detecting stegomalware in a file can be difficult and may involve testing the file behaviour in virtual environments or deep learning analysis of the file.

Chosen stego attack: the stegoanalyst perceives the final target stego and the steganographic algorithm used. Known cover attack: the stegoanalyst comprises the initial conductive target and the final target stego. Known stego attack: the stegoanalyst knows the initial carrier target and the final target stego, in addition to the algorithm used. Stego only attack: the stegoanalyst perceives exclusively the stego target. Chosen message attack: the stegoanalyst, following a message selected by him, originates a stego target. Known message attack: the stegoanalyst owns the stego target and the hidden message, which is known to them.

Passive steganalysis: does not alter the target stego, therefore, it examines the target stego in order to establish whether it carries hidden information and recovers the hidden message, the key used or both. Active steganalysis: changes the initial stego target, therefore, it seeks to suppress the transfer of information, if it exists. Figure 3: Steganography in Malware: Detection Guide for Defenders | KlaroSkope Learn An overview of digital steganography, particularly within images, for the computationally curious by Chris League, Long Island University, 2015 Examples showing images hidden in other images Information Hiding: Steganography & Digital Watermarking. Papers and information about steganography and steganalysis research from 1995 to the present. Includes Steganography Software Wiki list. Dr. Neil F. Johnson. Detecting Steganographic Content on the Internet. 2002 paper by Niels Provos and Peter Honeyman published in Proceedings of the Network and Distributed System Security Symposium (San Diego, CA, 6–8 February 2002). NDSS 2002. Internet Society, Washington, D.C. Covert Channels in the TCP/IP Suite Archived 23 October 2012 at the Wayback Machine – 1996 paper by Craig Rowland detailing the hiding of data in TCP/IP packets. Network Steganography Centre Tutorials Archived 16 December 2017 at the Wayback Machine. How-to articles on the subject of network steganography (Wireless LANs, VoIP – Steganophony, TCP/IP protocols and mechanisms, Steganographic Router, Inter-protocol steganography). By Krzysztof Szczypiorski and Wojciech Mazurczyk from Network Security Group. Invitation to BPCS-Steganography. Steganography by Michael T. Raggo, DefCon 12 (1 August 2004) File Format Extension Through Steganography by Blake W. Ford and Khosrow Kaikhah Computer steganography. Theory and practice with Mathcad (Rus) 2006 paper by Konakhovich G. F., Puzyrenko A. Yu. published in MK-Press Kyiv, Ukraine Titanium is a very advanced backdoor malware APT, developed by PLATINUM, a cybercrime collective. The malware was uncovered by Kaspersky Lab and reported on 8 November 2019. According to Global Security Mag, "Titanium APT includes a complex sequence of dropping, downloading and installing stages, with deployment of a Trojan-backdoor at the final stage." Much of the sequence is hidden from detection in a sophisticated manner, including hiding data steganographically in a PNG image. In their announcement report, Kaspersky Lab concluded: "The Titanium APT has a very complicated infiltration scheme. It involves numerous steps and requires good coordination between all of them. In addition, none of the files in the file system can be detected as malicious due to the use of encryption and fileless technologies. One other feature that makes detection harder is the mimicking of well-known software. Regarding campaign activity, we have not detected any current activity [as of 8 November 2019] related to the Titanium APT." Stegomalware is a form of malicious software that leverages steganography techniques to conceal its code, configuration data, or command-and-control (C&C) communications within seemingly benign digital media such as images, audio files, videos, documents, or network traffic. It typically embeds encrypted or obfuscated payloads into digital media and only extracts and executes them at runtime, which makes traditional signature-based and sandbox-based detection significantly more difficult. Stegomalware has been observed in attacks ranging from advanced persistent threats (APTs) to financially motivated cybercrime, and is now the subject of dedicated academic surveys, research projects, and international law-enforcement initiatives. The key distinction between stegomalware and traditional obfuscated malware lies in the encoding location. After obfuscation, malicious code remains present within the executable and can theoretically be discovered through static analysis. In contrast, stegomalware hides the payload entirely within a cover medium (image, audio, etc.), remaining invisible until the malware dynamically extracts and executes it at runtime.

Stegotext (R): An innocent-looking digital asset (image, audio file, etc.) into which the malicious payload is embedded. Secret key (sk): A key used by the embedding and extraction algorithms, typically hardcoded into the malware. Payload (p): The actual malicious code, configuration data, or C&C commands hidden within the stegotext. The malware extracts the payload at runtime using the secret key and either executes it directly or uses it to download additional stages of the attack.

Stegomalware can be classified into several types based on deployment method: Type 0 (Autonomous): Both the stegotext and extraction algorithm are embedded within the malware application itself. The malicious payload is extracted and executed locally without external communication. Type I (Update): The stegotext and secret key are downloaded from a remote server at runtime; only the extraction algorithm is included in the malware. This variant is more flexible, allowing attackers to push updated payloads. Type II (External Algorithm): Neither the stegotext nor the extraction algorithm are distributed with the malware; both are fetched from an attacker-controlled infrastructure, providing maximum flexibility and evasion.

HUGO (High Undetectable steGO) (2010): Minimizes detectable distortion by distributing the payload across multiple pixels, achieving embedding capacity with reduced statistical footprint. WOW (Wavelet Obtained Weights) (2012): Embeds data preferentially in textured regions of images where modifications are less perceptually noticeable. UNIWARD (Universal Wavelet Relative Distortion) (2014): Uses a universal distortion function applicable to multiple image formats, balancing payload capacity with undetectability. HILL (2014): Applies high-pass and low-pass filters to identify robust embedding regions. MiPOD (Minimizing the Power of Optimal Detector) (2016): Designed to minimize the power of theoretical optimal steganalysis detectors.

Embedding in DCT coefficients (used in JPEG compression) Embedding in DWT coefficients (used in lossless formats) Spread spectrum techniques, which distribute the payload across many frequency components Transform domain methods are generally more resistant to noise, compression, and image transformations than spatial methods. SGAN (Steganographic GAN) (2017): First GAN applied to steganography, using a generator, discriminator, and steganalysis network. ASDL-GAN (2017): Performs automatic steganographic distortion learning at the pixel level. SteganoGAN (2019): Improves upon earlier GAN models, achieving higher embedding capacity and robustness. HiGAN (Hiding Images GAN) (2020): Enables hiding one image within another while maintaining visual plausibility. GAN-based approaches are more resilient to standard steganalysis attacks but remain an emerging threat requiring further research.

Stegomalware has been documented in numerous high-profile cyber attacks and campaigns. Notable examples include: Operation Shady RAT (2011): Used digital images to hide command-and-control server addresses in targeted espionage. Duqu (2011): Embedded victim data into JPEG files to exfiltrate industrial control system information. Zeus/Zbot (2014): Masked banking configuration data inside JPEG files exploited via malvertising. Gatak/Stegoloader (2015): Hid shellcode in PNG files for software licensing attacks and bot command execution. TeslaCrypt (2015): Embedded C&C commands and ransomware keys in JPEG images. Cerber (2016): Concealed executable ransomware code in JPEG files distributed via phishing. DNSChanger (2016): Embedded malicious code in PNG files for DNS hijacking campaigns. Sundown Exploit Kit (2017): Distributed exploit code in PNG files via malvertising. AdGholas (2017): Used JPEG steganography to distribute ransomware via malvertising. Synccrypt (2017): Hidden ransomware components in JPEG-steganographic encrypted archives. ZeroT/PlugX (2017): Hid Remote Access Trojan payloads in BMP files for espionage. Loki Bot (2018): Concealed malware installers in JPEG and video files. Waterbug (APT28) (2019): Injected malicious DLLs into WAV audio files. Shlayer (macOS adware) (2019): Hid malicious URLs in JPEG files via malvertising.

Phishing emails with malicious attachments or links Malvertising campaigns using malicious banner advertisements Exploit kits through compromised or malicious websites Legitimate application vulnerabilities (e.g., watering-hole attacks) Fake software distribution (cracked software, keygen tools) Payload delivery: Stego images contain full executable code or shellcode. C&C communication: Hidden data contains server addresses or command instructions. Data exfiltration: Stolen data encoded into images to evade network inspection. Update mechanism: New malware versions delivered via stegomalware.

A variety of publicly available steganography tools can be repurposed for stegomalware creation: 2. System Architecture & Core Working Principles Steghide (2003): Open-source; LSB-based; supports JPEG, BMP, WAV, AU formats OpenPuff (2004): Java-based; multi-format support (BMP, JPEG, GIF, PNG, video) Xiao (2006): Simple Windows GUI; basic LSB embedding in BMP and WAV OpenStego (2015): Open-source; user-friendly interface; supports multiple formats StegExpose: Detection tool; statistical analysis for finding embedded data Binwalk: Firmware analysis and data extraction; useful for forensics Aperi'Solve: Web-based steganalysis tool combining multiple detection methods Advanced algorithms such as UNIWARD, HILL, WOW, and MiPOD require implementation from research papers rather than ready-to-use tools.

Detecting stegomalware is challenging because modifications are designed to be statistically invisible. Traditional antivirus solutions struggle since they primarily analyze executable files and network traffic, not embedded multimedia. Visual steganalysis: Human inspection for anomalies (rarely effective for modern techniques) Statistical steganalysis: Analysis of pixel distributions and histograms Signature-based steganalysis: Matching known tool signatures or patterns Rich model steganalysis: Domain-specific feature extraction with ensemble classifiers Deep learning-based steganalysis: Convolutional neural networks to distinguish natural from stego images Universal (blind) steganalysis: General-purpose detection regardless of embedding algorithm Very low embedding rates Adversarial training or GAN-based steganography Mixed file formats in datasets Encrypted payloads File-level analysis: Scanning for steganography signatures using tools like StegExpose or binwalk Dynamic behavior analysis: Using sandboxes to observe payload extraction and execution Network monitoring: Detecting suspicious patterns in traffic indicating exfiltration Machine learning models: Deploying trained classifiers to identify stego images Detection frameworks have been proposed for datacenters, cloud (AWS, Azure), and multi-cloud environments.

Raising awareness among law enforcement and the public about steganography threats Sharing threat intelligence on information hiding misuse Tracking emerging steganographic techniques in cybercrime Training law enforcement and forensic professionals Supporting investigations involving steganography CUIng's threat assessment identified steganography in diverse crimes including child sexual abuse material (CSAM), industrial espionage, enterprise cyberattacks, credit card fraud, and backdoor injection.

Analysis and cataloging of existing steganographic tools Development and validation of state-of-the-art steganalysis detectors Creation of a unified online platform for forensic analysis Field validation with law enforcement use cases Training and capacity building for agencies and institutes Legal frameworks for court admissibility across European jurisdictions UNCOVER demonstrated that operational steganalysis improves with metadata or partial information about the original media, such as JPEG steganalysis using leaked cover thumbnails.

Limited public datasets: Only the proprietary MalJPEG dataset (157,000 samples) exists; inaccessible to researchers. Lack of real-payload evaluation: Most research uses generic steganographic images, not actual malware-embedded images. Adversarial robustness: Attackers use adversarial training and GANs to evade detectors. Multi-format detection: Methods specialize in single formats (JPEG) and struggle with mixed datasets. Audio/video steganography: Limited research on detecting steganography in WAV, MP3, and video files. Stegomalware in neural networks: Emerging threat of embedding payloads in pre-trained deep learning model weights. Scalability in enterprises: Large-scale deployment introduces computational and false-positive challenges. Emerging techniques: Novel GAN-based and context-aware steganography may outpace detection. Future research priorities include: Developing public stegomalware datasets and benchmarks Evaluating detectors against real malware payloads Cross-domain and cross-format steganalysis methods Integrating cryptanalysis with steganographic detection Harmonizing legal frameworks for cross-border investigations Twelve detection techniques for payloads hidden in images, and where to go deeper on each Steganographic malware hides payloads inside legitimate-looking carrier files (typically images) so the malicious content evades content inspection that targets scripts and binaries. The carrier file remains valid: a PNG with embedded payload still opens in image viewers and passes signature checks. KlaroSkope detects steganography across twelve techniques covering tool signatures, post-EOF appends, delimiter scanning, EXIF injection, PNG chunk abuse, polyglot files, LSB pixel encoding, alpha-channel differences, palette tricks, and pixel-byte storage. Recovered payloads run through the deobfuscation chain and the post-extraction crypto pipeline.

Steganography used to be the technique you saw in incident reports about sophisticated operators and rarely anywhere else. Commodity malware did not need it; ordinary script obfuscation worked well enough against the defences in place. That changed during 2024 and accelerated through 2025 and 2026. The shift is not about new mathematics or new file formats. It is about tooling. Builder kits and tutorials now automate the embedding step, so an operator who has never opened a hex editor can ship payloads inside images. Image files pass mail gateway content inspection, pass antivirus scans that focus on scripts and PEs, and pass casual analyst review because they are valid images. The carrier files used in the GHOSTPULSE v2, GhostPoster (DarkSpectre lineage), IcedID, and ClickFix-LummaC2 campaigns all open correctly in standard viewers; the malicious content is in places the viewers do not look. This is a working reference for the twelve detection techniques KlaroSkope runs on every uploaded image. Each technique targets a different embedding strategy. The article covers the structural signal each technique looks for, the campaign or family that motivated its inclusion in the analysis pipeline, and what KlaroSkope does with payloads it recovers. There is also an honest section on encrypted payloads: when keys are recoverable, when they are not, and what KlaroSkope reports in either case.

This guide is the entry point for payloads hidden in carrier files. Six companion articles each take one part of the problem further. Read them in any order; each links back here. Definition and taxonomy. What stegomalware is, how the Type 0, Type I, and Type II distribution classes differ, and the four roles steganography plays across the kill chain. See What is Stegomalware? .

Delivery. How the carrier reaches the endpoint: image attachments, hosting on trusted platforms and CDNs, and browser-extension assets. See Steganographic Malware Delivery . Detection technique deep dive. The mechanics behind the passes below: Shannon entropy profiling, chi-square and RS statistical tests for LSB, PNG chunk parsing, and format-boundary checks. See Steganography Detection Techniques .

Extraction. The attacker-side logic that recovers a payload from its carrier, method by method, and what each routine tells a defender about the chain to reverse. See Steganographic Payload Extraction . PDF carriers. When the carrier is a document rather than a standalone image, and analysis has to cross the PDF, image, and payload layers in one pass. See Analysing Steganographic Document Attacks .

Post-extraction. What to do with encrypted bytes once they are out: cipher identification, key recovery, trial decryption, and quality validation. See The Post-Extraction Pipeline . Three campaign clusters drove the recent shift from APT-only to commodity-level steganographic delivery. None of them invented new techniques; all of them industrialised techniques that already existed.

GHOSTPULSE moved from PNG IDAT chunk embedding (v1, documented from 2023) to direct byte storage inside pixel values protected by a CRC32 integrity check (v2, documented through 2024 and 2025). The v2 shift specifically targeted analysers that inspected ancillary PNG chunks but did not parse pixel data. GhostPoster, the DarkSpectre browser-extension lineage Koi Security catalogued at roughly 8.8 million affected browsers, embedded payloads in extension icon files using delimiter-marker scanning so the loader could find the payload regardless of the surrounding icon content. IcedID has used PNG steganography with RC4-encrypted payloads since 2022, a pattern that the GHOSTPULSE and GhostPoster operators effectively scaled up. Through 2026, Huntress reporting on ClickFix-LummaC2 delivery and Veracode's buildrunner-dev supply-chain disclosure both documented PNG-carrier stages in distribution chains where steganography would not have appeared at this volume two years earlier.

The economics favour image carriers. A PNG with embedded payload costs nothing extra to host or deliver, evades the tools that scan scripts and binaries, and can be served through legitimate CDNs. The only friction is the embedding step, which builder tools have eliminated. Each detection technique below targets a specific embedding strategy. Some are structural (file size, chunk types, EOF markers); some are pixel-level (LSB, alpha, palette, direct bytes). All twelve run on every uploaded image. The aggregate result is a per-technique status table (found, clean, or not applicable) plus the recovered payloads themselves with their cipher identification and entropy classification attached.

Decode steganography end to end. Upload an image at klaroskope.com/submit and KlaroSkope runs all twelve techniques, dispatches recovered payloads through the deobfuscation chain, and runs the post-extraction crypto pipeline on encrypted output. Open-source steganography tools leave fingerprints. Steghide writes specific magic bytes in JPEG comment segments.

OpenStego marks PNG payloads with a header string in ancillary chunks. SilentEye uses a recognisable initialisation pattern. KlaroSkope scans the first 64 KB of every uploaded image (case-insensitively, bounded to avoid scanning multi-megabyte pixel data) for these markers. A positive hit narrows the analysis path to that tool's known extraction routine. A negative hit does not rule out tool use; signatures can be stripped or modified by the operator.

3. Software Implementation, Frameworks & Protocols Image formats have explicit end markers: PNG ends at the IEND chunk, JPEG at FFD9, BMP at the size declared in its header, GIF at 3B, ICO at the end of its image directory entries. Image viewers stop reading at the marker. Anything after it is invisible to the viewer but reachable by extraction code. KlaroSkope locates the format-specific end marker, treats the trailing bytes as a payload candidate, and reports its size and entropy. The technique catches commodity stegomalware that simply concatenates a payload to the carrier; its prevalence in long-tail samples is high precisely because the embedding is trivial to implement.

Some operators do not append after EOF; they place a recognisable marker (a magic byte sequence, a known string, a builder-specific token) inside the file, with the payload following. The loader scans for the marker and extracts everything after. KlaroSkope checks for the marker patterns documented in active campaigns: GhostPoster's icon-file markers (the DarkSpectre browser-extension lineage), IDAT Loader's chunk-internal markers, and several builder-specific delimiters. A delimiter hit returns a payload candidate plus the offset where the marker was found, useful for clustering samples by builder.

EXIF and adjacent metadata structures (XMP, IPTC, JFIF comments) are designed to carry text fields about cameras, copyright, and editing history. Operators repurpose them as payload storage. KlaroSkope inspects every metadata field for Base64 patterns (with the characteristic alphabet plus padding) and hex strings with sufficient length. Recovered payloads are decoded inline and forwarded to the deobfuscation chain. Webshell distribution often uses this pattern because PHP loaders that parse EXIF are short and easily concealed in benign-looking image-upload code.

A subtler variant of EXIF abuse: instead of writing a payload as a single field value, operators interleave payload bytes with null padding so the field appears empty or short to a metadata stripper that only inspects the visible portion. KlaroSkope walks the binary content of EXIF entries, treats sequences of null bytes as candidate boundaries, and reconstructs the embedded payload from the gaps. The technique is less common than direct injection but defeats sanitisers that only check field length or visible content.

PNG defines critical chunks (IHDR, IDAT, IEND) that decoders must process and ancillary chunks (tEXt, zTXt, iTXt, plus arbitrary private chunks) that decoders may ignore. Ancillary chunks are designed for metadata. They become payload storage when an operator writes Base64, hex, or raw bytes into them. KlaroSkope walks every chunk of an uploaded PNG, identifies non-standard payloads in tEXt and zTXt entries, surfaces private-chunk content, and treats raw chunk data above an entropy threshold as a payload candidate. Operators using OpenStego land here because OpenStego's default mode writes to ancillary chunks.

IDAT carries the actual compressed image data. Most analysers do not look there because anything inside IDAT is compressed image content by definition. Operators exploit this by either inserting marker bytes inside IDAT and embedding payload around them (the IDAT marker pattern), or by writing high-entropy payload bytes into a region of IDAT and relying on the image still rendering visually. KlaroSkope decompresses IDAT, scans for marker patterns, and applies an entropy threshold to flag regions that do not look like compressed pixel data. IcedID and the GHOSTPULSE v1 lineage both used this technique, which is why it has its own dedicated detection pass rather than being folded into general chunk inspection.

A polyglot file is simultaneously valid as multiple formats. A common pattern in malware delivery is image + archive: the file opens correctly as a PNG or JPEG in an image viewer, and is also a valid ZIP, RAR, GZIP, or PE when read by the appropriate parser. KlaroSkope checks every uploaded image for polyglot signatures (ZIP local-file headers, RAR magic, PE MZ headers, GZIP magic, HTML or PHP shell tokens) anywhere in the file, not just at the start. A polyglot hit returns the embedded format, the offset where it begins, and a payload candidate consisting of the embedded format's bytes. This is a recurring pattern in format-boundary attacks where the carrier traverses parsers that only recognise one format each.

Least-significant-bit encoding stores payload bits in the lowest-order bit of pixel channel values. A single-bit RGB encoding hides 3 bits of payload per pixel; a 2-bit encoding hides 6. The visual change is imperceptible because each channel value changes by at most 1 (for 1-bit) or 3 (for 2-bit) units out of 256. The challenge for detection is that operators vary the channel order, bit count, and traversal direction per build, and a decoder configured for the wrong combination produces noise that looks like a failure to detect anything. KlaroSkope tries six configurations per image: RGB row-major (the default in most builders), R-only row-major, BGR row-major (some Windows-native builders use BGR ordering), RGB 2-bit row-major (higher payload density), RGBA row-major (including the alpha channel), and R-only column-major. A payload candidate from any configuration triggers the post-extraction crypto pipeline.

Images with an alpha channel carry a fourth byte per pixel that controls transparency. In most carrier images the alpha channel is either fully opaque or follows a smooth gradient. Operators encode payload bytes as differences in alpha values: instead of storing the byte directly in alpha, they vary alpha by the byte value relative to a baseline. The image looks identical because the alpha differences are too small to perceive. KlaroSkope computes the per-pixel alpha differences against the running baseline and reconstructs the payload bytes. The technique is associated with the Stegano library and its derivatives, including AdGholas-style steganographic carriers.

Palette-indexed images (8-bit PNG, GIF, some BMP variants) use a palette of up to 256 colours, and each pixel stores an index into that palette. Operators exploit this in two ways. Palette index abuse: shuffle the palette so the indices spell out the payload when read sequentially while the visible image stays correct (because the palette entries are rearranged to compensate). Palette-as-bytes: write the payload directly into unused palette entries, accepting some visual artefacts in regions of the image that do not reference those entries. KlaroSkope inspects the palette and the index sequence for both patterns. The technique appears in custom 8-bit PNG and GIF builders rather than mainstream tools.

The most aggressive pixel-level technique: store payload bytes directly in pixel values, accepting that the image will be visibly modified, and protect the payload with a CRC32 integrity check so the loader can verify it received the correct bytes. The visual modification is acceptable in carrier files designed to be small and unobtrusive (extension icons, tiny PNGs in corners of web pages) where users are not likely to notice. KlaroSkope identifies the technique by looking for CRC32-protected byte sequences in pixel data and by flagging high-entropy pixel regions in carrier images that should not have them.

GHOSTPULSE v2 is the documented public example; the technique generalises to any custom loader that prefers CRC32 protection over the silent corruption that LSB and alpha-difference encoding leave behind. Recovering an embedded payload is the first step. Most modern stegomalware encrypts that payload before embedding, so the bytes KlaroSkope extracts are ciphertext. The post-extraction crypto pipeline takes over: identify the cipher by entropy and structural signals (AES-aligned block sizes, recognisable GCM tags, statistical XOR fingerprints), recover the key from any of four sources, and run trial decryption.

The four key sources are: image metadata (EXIF fields and PNG text chunks frequently carry the key as Base64 or hex alongside the payload), the payload itself (some loaders prepend the key), OSINT threat intelligence (published campaign keys for AsyncRAT, IcedID, XWorm, and similar families), and the surrounding loader script context when an obfuscated script is recovered together with the image. KlaroSkope checks all four. Any candidate key that produces output passing the quality gate (Q greater than or equal to 0.40) is reported as a successful decryption with the cipher identification and confidence attached.

When the key is derived at runtime from values KlaroSkope cannot observe (the loader fetches a key from a registry hive, computes one from system identifiers, or pulls one from C2 on first contact), the payload stays encrypted. KlaroSkope reports the cipher identification, the entropy classification, the encryption hint (AES-aligned blocks, DES-aligned blocks, stream cipher, or custom scheme), and the unsuccessful trial decryption attempts. The extracted ciphertext is preserved in the analysis output for manual investigation or for reanalysis once the threat-intel community publishes the relevant key. This honesty is the credibility: a tool that fabricates plausible-looking decryption when none succeeded would be worse than a tool that says 'cipher identified, key not recovered'.

Cipher identification is probabilistic. Single-byte XOR can produce false-positive 'decryptions' on small inputs because any 256-key trial against a short ciphertext is likely to produce SOMETHING that looks plausible. KlaroSkope gates such trials on quality scores at or above 0.80 to avoid surfacing garbage. Multi-byte XOR and the modern symmetric ciphers (AES variants, ChaCha20, RC4) have stronger structural signals; their identification is much more reliable.

Upload an image. KlaroSkope runs all twelve detection techniques, attaching to each a per-technique status (found, clean, or not_applicable for techniques that do not apply to the format). Recovered payloads carry their entropy classification and any encryption hint. Encrypted payloads run through the post-extraction crypto pipeline; successfully decrypted output flows into the standard deobfuscation chain alongside the rest of the analysis. The verdict (payload_found, suspicious, or clean) is surfaced at the top of the result, and the decoder chain, recovered IOCs, generated YARA and Sigma rules, and the analyst-view layer breakdown follow. The whole pipeline is static: no execution of recovered scripts, no rendering of carrier images for behavioural analysis, no network. This is the same pipeline covered in steganography detection techniques and steganographic payload extraction , with this article serving as the comprehensive reference for the twelve detection passes themselves.

For analysts, the practical impact is throughput. A single sample that would take 30 to 90 minutes to manually triage with CyberChef, exiftool, zsteg, and a hex editor decodes in seconds with the chain visible end to end. For SOC teams processing dozens of suspicious image samples per week, the math changes investigation throughput from hours per sample to minutes. Try it now --> klaroskope.com/submit - upload an image suspected of carrying a hidden payload (for example PNG, JPEG, BMP, GIF, or ICO, or a polyglot file), and see the per-technique status table, recovered payload extraction, cipher identification, and decoded output where keys are available. Free tier handles the same multi-technique chains active malware uses.

The mechanics behind each detection pass: Shannon entropy profiling, chi-square and RS statistical tests, PNG chunk parsing, and format-boundary checks The extraction logic itself, method by method: appended data, LSB pixel encoding, chunk and metadata injection, IDAT pixel streams, and offset-marker scanning The definition, the Type 0 / Type I / Type II classification, the four roles it plays in an attack, and the decade of campaigns behind them Extraction is the easy part. What happens next determines whether you get intelligence or garbage.

Image attachments, hosting on trusted platforms, and extension assets: the delivery channels that carry concealed payloads past content inspection How defenders can use encryption keys for attribution, family identification, and faster incident response Steganography detection, or steganalysis, is the process of identifying the presence of hidden information within a cover medium, such as an image file. The rise of sophisticated data-hiding techniques requires equally advanced detection methods. This document outlines the foundational approach for a machine learning (ML) model designed to perform preliminary detection of steganographically altered image files.

4. Practical Deployment, Analysis & Case Studies The primary objective of this capability is a ML model that analyzes image files and triggers alerts when structural anomalies consistent with known steganography tools and methods are detected. These methods often leave discernible statistical “footprints” in the image data, particularly in areas like the Least Significant Bit (LSB) planes. Consequently, the detection capability is generally agnostic to payload characteristics, such as language.

The feature can be turned on by request for a tenant for customers with DLP Advanced (L3), but has no further policy or profile implication. Upon activation, files conforming to the outlined specifications will undergo automated scanning by the model to ascertain the potential presence of steganography, subsequently triggering an alert.To find an alert, please navigate to “ Skope IT ” – “ Alerts ” and check for Alert Type “ DLP ” with Name “ All DLP Policies ” which under the File section will display “Steganography Detected: true”.

To deactivate Steganographic detection for your tenant, kindly contact us to arrange its deactivation. This is the repository for my final year project for the Bachelor of Science in Computer Science at IQRA University. SMDS is a fully functional desktop security application designed to proactively detect and prevent stegomalware—malicious payloads hidden within digital images.

Traditional antivirus solutions are often ineffective against stegomalware because they do not analyze the underlying statistical and structural properties of media files where the malware is hidden. This creates a significant security vulnerability that attackers can exploit to bypass standard defenses. This project was developed as part of the partial fulfillment of the requirements for the degree of Bachelor of Science in Computer Science.

A desktop security application to detect and prevent malware hidden in images using a three-tier analysis engine (Deep Learning, Statistical, Behavioral). This repository provides a curated list of benchmark datasets and state-of-the-art (SOTA) models for the field of image steganalysis. The goal is to offer a centralized resource for researchers and practitioners to easily find and compare relevant work.

A collection of standard datasets used for training and evaluating steganalysis models. These models represent the era of "rich models" where feature sets were manually engineered to capture steganographic noise. They remain important benchmarks. A curated collection of benchmark datasets, state-of-the-art models, and resources for image steganalysis research, covering both spatial and JPEG domains with deep learning and handcrafted approaches.

Image attachments, hosting on trusted platforms, and extension assets: the delivery channels that carry concealed payloads past content inspection Steganography in malware delivery is the practice of concealing malicious code within ordinary-looking image files. Unlike encryption, which makes data unreadable, steganography makes data invisible. The image displays normally in any viewer while carrying embedded payloads that can be extracted and executed by malware at runtime. This technique has seen significant adoption in 2024-2026 as attackers seek delivery mechanisms that bypass modern security controls.

Modern endpoint security has become remarkably effective at catching traditional malware. Signature databases contain millions of known threats. Behavioural analysis monitors process activity in real time. Machine learning models flag anomalous patterns before execution completes. This success has created a paradox. As detection improves, attackers invest more heavily in evasion. The arms race has pushed malware development toward techniques that operate outside the visibility of conventional security tools.

New to the topic? Start with Steganography Detection: The Complete Malware Analysis Guide , which covers the twelve detection techniques end to end. This article stays on the delivery side: how the carrier reaches the endpoint in the first place. Steganography represents one such technique. An image file containing hidden malware looks identical to a clean image. It shares the same file type, the same structure, and often the same visual content. Security scanners that examine file headers, parse known malware signatures, or analyse executable content find nothing to flag. The malicious payload exists, but it exists in a form these tools are not designed to see.

Steganography is not new. Security researchers documented malware using hidden image payloads as early as 2011. But the technique remained relatively rare through the mid-2010s, used primarily by sophisticated threat actors who could justify the additional development complexity. That changed around 2020. Several factors converged to make steganography attractive to a broader range of attackers.

Endpoint detection and response solutions became widespread. EDR promised visibility into process behaviour that signature-based antivirus could not provide. For attackers, this meant that traditional droppers and loaders faced scrutiny they had previously avoided. Hiding the payload outside the executable became more valuable when the executable itself was under constant observation.

Cloud infrastructure normalised image hosting. Malware that fetches payloads from external servers can be blocked by reputation systems or URL filtering. But images hosted on legitimate services like GitHub, Imgur, or content delivery networks blend into normal traffic. A loader fetching its payload from a PNG on a trusted domain raises fewer alerts than one connecting to a suspicious IP address.

Browser extensions emerged as a delivery vector. The GhostPoster campaign, documented in late 2025, demonstrated the technique at scale. Malicious extensions hid JavaScript payloads inside their own icon files. The extensions installed through official stores, displaying the icons normally while carrying embedded code that would execute days after installation. The common thread across these drivers is trust exploitation. Steganography works because images are trusted file types.

Legitimate hosting works because the platform is trusted. Extensions work because the store is trusted. Attackers aren't breaking defences. They're routing around them through channels defenders haven't instrumented. The techniques vary in sophistication, but they share a common principle: exploit the gap between what parsers require and what files can contain.

IcedID (2020-present) began as a banking trojan in 2017 but adopted steganography around 2020. Its loaders fetch PNG images from attacker infrastructure, locate the encrypted payload within IDAT chunks using embedded markers, extract the data, and decrypt it using an RC4 key stored in the image itself. The resulting images appear grey and noisy because the pseudo-random encrypted data produces high-entropy pixel values. Security teams can identify suspected IcedID images by measuring Shannon entropy in the IDAT segment; values approaching 8.0 indicate likely encrypted content.

5. Performance Evaluation & Extended Technical Observations GHOSTPULSE (2023-present) demonstrates rapid technique evolution. The original version, documented by Elastic Security Labs in October 2023, searched PNG files for an "IDAT" string marker followed by a four-byte validation tag. Matching chunks were concatenated, XOR decrypted, and decompressed. By October 2024, GHOSTPULSE had shifted entirely to pixel-level encoding. The new version uses Windows graphics APIs to extract RGB values sequentially, then validates 16-byte blocks using CRC32 checksums embedded in the first four bytes of each block. Only blocks passing validation contain payload data.

This approach eliminates the string markers that detection rules targeted in the original version. GHOSTPULSE's evolution from v1 to v2 illustrates the arms race in steganographic malware. Version 1 relied on string markers that defenders could write YARA rules against. Version 2 eliminated those markers entirely, embedding payload data directly in pixel values validated by CRC32 checksums. The detection approach had to shift from signature matching to statistical analysis.

GhostPoster (2025-2026) applied steganography specifically to browser extensions. The campaign hid payloads after PNG IEND markers in extension icon files, using delimiter sequences to mark the start of hidden data. Firefox variants used triple equals signs; Chrome and Edge variants used four greater-than symbols. The payload was XOR encrypted using the extension's runtime identifier as the key, then Base64 encoded, then run through a character substitution cipher that swapped uppercase and lowercase letters and exchanged the digits 8 and 9. This layered encoding produced content that appeared random and defied simple pattern matching.

Witchetty (2022) took a different approach, hosting its steganographic images on GitHub. The group embedded an XOR-encrypted backdoor in a Windows logo bitmap, fetching it from a repository that appeared to contain legitimate graphics. This technique exploited the reputation of a trusted platform while placing the payload outside infrastructure the attackers directly controlled.

Payload separation reduces exposure. When the malicious code resides in an image rather than the loader, compromise of the loader does not immediately reveal the payload. Analysts who capture and reverse the loader find only extraction logic. They must also obtain the correct image, identify the embedding technique, and successfully extract the hidden data before they can analyse the actual malware.

Infrastructure flexibility improves. Images can be hosted on legitimate services, rotated between hosts, or embedded directly in documents and emails. A single loader can fetch different payloads from different images based on target characteristics. The same steganographic format can carry credential stealers, ransomware loaders, or remote access tools depending on the campaign's objectives.

Detection rules age quickly. Signature-based detection depends on identifying consistent patterns. Steganographic techniques can be varied almost arbitrarily: different embedding methods, different encoding schemes, different encryption keys. Each variation potentially requires new detection logic. Defenders must anticipate techniques rather than simply cataloguing known samples.

File size analysis provides a starting point. An image file significantly larger than its dimensions require may contain appended data. A 100x100 pixel PNG at 24-bit colour depth needs roughly 30 kilobytes for image data plus overhead. A file of that size approaching one megabyte warrants examination. Entropy measurement identifies encrypted or compressed hidden content. Clean images have structured entropy that varies by region: edges, textures, and gradients produce different distributions. Hidden encrypted payloads have entropy approaching the theoretical maximum of 8.0 bits per byte. Measuring entropy across IDAT chunks, appended data, or extracted LSB planes can flag anomalies.

Structural analysis parses the image format to identify non-standard elements. PNG files should not contain private chunks with high-entropy data. JPEG files should not have kilobytes of content after the EOI marker. EXIF metadata should not contain Base64-encoded strings or executable code patterns. Steganography creates an asymmetric challenge. Attackers choose the embedding technique, the encoding scheme, and the encryption method. Defenders must detect all variations, ideally before the payload executes.

This asymmetry favours defence in depth. No single detection method catches all steganographic techniques. Effective security combines multiple approaches: file anomaly detection, entropy analysis, structural parsing, and behavioural monitoring of extraction attempts. The extraction moment offers a detection opportunity. When malware extracts its hidden payload, it exhibits distinctive behaviour: fetching image resources and processing them as binary data rather than displaying them, scanning for specific byte patterns, and routing decoded output to execution functions. Monitoring for these patterns can catch steganographic attacks even when the image itself evades static analysis.

But the real challenge is what happens after extraction. The hidden payload is almost never the final form. It is typically obfuscated through multiple layers: XOR encryption revealing Base64, which decodes to compressed data, which decompresses to obfuscated JavaScript or PowerShell. Manually chaining tools for each layer is where most analysis stalls. This is the problem KlaroSkope was built to solve. It handles the complete chain automatically: steganographic extraction, multi-layer deobfuscation (130+ decoding techniques, 20+ layers deep), IOC extraction, MITRE ATT&CK mapping, and generates YARA rules, Sigma rules, and a full analysis report. The entire pipeline runs in under a minute on the free tier. No tool-chaining, no manual decoding, no context-switching between a dozen utilities.

Submit a suspicious file or paste obfuscated code and get the full analysis pipeline, from steganography extraction through to IOC report, for free. Try KlaroSkope Free For specific extraction methods and tool recommendations, see Steganography Detection Techniques . For how steganography combines with browser extension abuse, see Analysing Malicious Browser Extensions .

Understanding specific techniques also enables targeted detection. Campaigns reuse methods. GHOSTPULSE v1's IDAT marker scanning produces detectable access patterns. GhostPoster's delimiter sequences can be flagged in JavaScript analysis. Knowledge of how particular families implement steganography translates directly into detection rules. Twelve detection techniques for payloads hidden in images, and where to go deeper on each The mechanics behind each detection pass: Shannon entropy profiling, chi-square and RS statistical tests, PNG chunk parsing, and format-boundary checks The definition, the Type 0 / Type I / Type II classification, the four roles it plays in an attack, and the decade of campaigns behind them The extraction logic itself, method by method: appended data, LSB pixel encoding, chunk and metadata injection, IDAT pixel streams, and offset-marker scanning Extraction is the easy part. What happens next determines whether you get intelligence or garbage.

UPD: The section “Additional tasks” has been updated to include a new November 2023 steganography campaign. Malware delivery techniques are always evolving to bypass security measures. Gone are the days when a scammer could simply send an executable file as an email attachment — today, it simply won’t get past email filters. Harvested Online Documentation & Reference Sources • https://en.wikipedia.org/wiki/Steganography • https://en.wikipedia.org/wiki/Titanium%20%28malware%29 • https://en.wikipedia.org/wiki/Stegomalware • https://klaroskope.com/learn/steganography-malware-detection-guide • https://docs.netskope.com/en/steganographic-detection • https://github.com/asfand06/Steganographic-Malware-Detection-System • https://github.com/zedsharifi/awesome-steganalysis • https://klaroskope.com/learn/steganography-malware-delivery • https://any.run/cybersecurity-blog/steganography-in-malware-attacks/