Within an innocent-looking image, such as a breathtaking landscape or a funny meme, a hidden threat could be lurking, waiting for the perfect moment to strike.

There are no suspicious file names or antivirus warnings, just a harmless picture that secretly conceals a payload capable of stealing data, executing malware, and taking over your system without leaving a trace.

This technique is known as steganography, a cybercriminal’s secret weapon for concealing malicious code inside harmless-looking files. By embedding data within images, attackers evade detection and rely on separate scripts or processes to extract and execute the hidden payload.

Let’s break down the process of how this works, why it’s so dangerous, and most importantly, how to stop it before it’s too late.

What is Steganography in Cybersecurity?

Steganography refers to the practice of concealing data within another file or medium. Unlike encryption, which scrambles data to make it unreadable, steganography disguises malicious code inside harmless-looking images, videos, or audio files, making it nearly invisible to traditional security tools.

In cyberattacks, adversaries embed payloads into image files, which are later extracted and executed on the victim’s system.

Why cybercriminals use steganography:

• Evasion of security tools: Hidden code inside images bypasses antivirus and firewalls.
• No suspicious files: Attackers don’t need obvious executable files.
• Low detection rate: Traditional security scans rarely inspect images for malware.
• Stealthy payload delivery: Malware stays hidden until extracted and executed.
• Bypasses email filters: Malicious images don’t trigger standard phishing detections.
• Versatile attack method: Can be used in phishing, malware delivery, and data exfiltration.

How XWorm Uses Steganography to Evade Detection

Let’s analyze a malware campaign inside the ANY.RUN Interactive Sandbox that showcases exactly how steganography can be used in a multi-stage malware infection.

View analysis session with XWorm

Steganography campaign starting with a phishing PDF

Step 1: The Attack Starts with a Phishing PDF

We see inside ANY.RUN’s sandbox session that it all begins with a PDF attachment. The document includes a malicious link that tricks users into downloading a .REG file (Windows Registry file).

Explore ANY.RUN’s advanced features to uncover hidden threats, enhance threat detection, and proactively defend your business against sophisticated attacks.

Try ANY.RUN now

At first glance, this might not seem dangerous. But opening the file modifies the system registry, planting a hidden script that executes automatically when the computer restarts.

.REG file used to modify registry inside ANY.RUN sandbox

Step 2: The Registry Script Adds a Hidden Startup Process

Once the .REG file is executed, it silently injects a script into the Windows Autorun registry key. This makes sure that the malware launches the next time the system reboots.

At this stage, no actual malware has been downloaded yet, just a dormant script waiting for activation. This is what makes the attack so sneaky.

Autorun value change in the registry detected by ANY.RUN

Step 3: PowerShell Execution

After a system reboot, the registry script triggers PowerShell, which downloads a VBS file from a remote server.

Inside the ANY.RUN sandbox, this process is visible on the right side of the screen. Clicking on powershell.exe reveals the file name being downloaded.

Powershell.exe downloading a VBS file inside a secure environment

At this stage, there is no obvious malware, just a script fetching what appears to be a harmless file. However, the real threat is concealed within the next step, where steganography is used to hide the payload inside an image.

Step 4: Steganography Activation

Instead of downloading an executable file, the VBS script retrieves an image file. But hidden inside that image is a malicious DLL payload.

Image with malicious DLL payload detected by ANY.RUN

Using offset 000d3d80 inside ANY.RUN, we can pinpoint where the malicious DLL is embedded in the image file.

Static analysis of the malicious image

Upon static analysis, the image appears legitimate, but when we inspect the HEX tab and scroll down, we find the <> flag.

Directly after this flag, we see “TVq,” the Base64-encoded MZ signature of an executable file. This confirms that steganography was used to conceal the XWorm payload inside the image, allowing it to bypass security detection until extracted and executed.

Step 5: XWorm is Deployed Inside the System

The final step of the attack involves executing the extracted DLL, which injects XWorm into the AddInProcess32 system process.

XWorm malware detected by ANY.RUN sandbox

At this point, the attacker gains remote access to the infected machine, allowing them to:

• Steal sensitive data
• Execute commands remotely
• Deploy additional malware
• Use the infected system as a launching point for further attacks

Uncover Hidden Threats Before They Strike

Steganography-based attacks are a growing challenge for businesses, as traditional security tools often overlook hidden malware inside images and other media files. This allows cybercriminals to bypass detection, steal data, and infiltrate systems without triggering alarms.

With tools like ANY.RUN’s interactive sandbox, security teams can visually track every stage of an attack, uncover hidden payloads, and analyze suspicious files in real time:

• Save time with fast threat analysis: Get initial results in just 10 seconds and streamline your threat assessment process.
• Collaborate efficiently: Share results instantly and work together in real-time sessions to accelerate team tasks.
• Simplify investigations: Utilize ANY.RUN’s intuitive interface and real-time flagging to reduce workload and enhance productivity.
• Gain actionable insights: Leverage extracted IOCs and MITRE ATT&CK mapping for effective triage, response, and threat hunting.
• Enhance response: Improve data transfer from SOC Tier 1 to SOC Tier 2 with comprehensive reports for more effective escalation.

Proactively monitoring suspicious activity and testing potential threats in a controlled environment is key to strengthening your cybersecurity posture.

Try ANY.RUN’s advanced features and gain deeper visibility into threats, and make faster, data-driven decisions to protect your business.