A Malware Campaign Uses PNG Steganography to Hide Payloads in Images
A recent malware campaign has caught the attention of cybersecurity experts due to its innovative use of steganography, a technique that conceals data within seemingly innocuous files. The threat actors behind this campaign have been using PNG images to hide malicious payloads, making it difficult for security software to detect them. In this article, we’ll take a closer look at how this works and what it means for online security.
The TerminalFix campaign, which was first identified by Microsoft Security Research, uses PNG files with embedded payloads in a way that’s both clever and concerning. By exploiting the fact that PNG images can contain metadata, such as pixel data, the threat actors have managed to hide malicious code within seemingly ordinary images. This is achieved through the use of steganography, which allows them to embed the payload within the image itself.
Analysis of one of the affected PNG files reveals that it appears to be a valid image at first glance. The file starts with the expected header and contains the usual chunks of data found in a minimal PNG file: IHDR, IDAT, and IEND. However, upon closer inspection using specialized tools, experts have discovered that the IDAT chunk contains encoded pixel data, which is actually a compressed Windows executable – known as a PE file.
Breaking down the code within the image reveals that it’s a genuine Microsoft executable called LockScreenContentServer.exe, which is used for sideloading. This suggests that the threat actors are using this technique to distribute malware payloads through seemingly legitimate images.
What’s particularly interesting about this campaign is that the threat actors have decided to use all available bits to store the payload within the image, rather than just some of them. This means that the original medium is essentially lost, and the PNG file can only be rendered as a distorted image. The two other affected PNG files contain the malicious payload in two parts, also using this technique.
The implications of this campaign are significant, as it highlights the ongoing cat-and-mouse game between threat actors and security experts. By pushing the boundaries of what’s possible with steganography, these attackers have demonstrated just how creative and cunning they can be when it comes to evading detection.
So what does this mean for online security? The key takeaway is that users need to remain vigilant and cautious when dealing with seemingly innocuous files. Even if a file appears to be a valid image or document, it may still contain malicious code hidden within its metadata. As always, users should be wary of downloading attachments or clicking on links from unknown sources.
In practical terms, this means that organizations should prioritize robust security measures, including regular software updates and thorough scanning for malware. Users can also take steps to protect themselves by being mindful of the files they download and sharing information only with trusted sources. By staying one step ahead of these threat actors, we can minimize the risks associated with such attacks.
Source: SANS ISC — 2026-09-21