Attackers exploit AhsayCBS flaws to hide code in PNGs and plant backdoors
Three servers in one organization were hit October 8–11, 2026, via auth bypass and unauthenticated SYSTEM RCE before hotfixes.
Stories per day · 30 days
1 RSS
Relatedclickfix2diffusion2dll-sideloading2powershell2agentic-ai1ahsaycbs1backup1cloudflare1copyright1domain-controller1duskdesk1forgery-detection1hmac1image-watermark1infostealer1mcp1painting1prompt-injection1
14 stories, newest first · one card per story
Stories tagged #steganography
Fake Cloudflare CAPTCHA ClickFix lures hide malware in PNG images
Huntress says pasted PowerShell rebuilt full executables from PNG pixel data, then added persistence and lateral movement.
Training-free multi-bit image watermark resists removal and forgery
Authors report a scalable 32–128-bit payload, a 94.6% decode rate against CtrlRegen+, and 98.8% forgery detection.
Decode-time provenance binding blocks MCP steganographic prompt injection
On a real MCP testbed, 24 adaptive payloads succeeded 100% undefended and 0% with the proposed mechanism.
BrushOff stroke re-rendering strips robust painting watermarks, study finds
On 500 paintings, VINE detection fell from at least 97.8% under distortions to 1.8% after stroke repainting.
Earth Sirrush Espionage Activity May Support Sandworm Operations Against Ukraine
Earth Sirrush has spear-phished Ukrainian government and logistics since 2022, possibly feeding Sandworm.
8
Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix Lures
Huntress details attackers abusing ChatGPT Custom GPTs with ClickFix lures to deliver a full-featured RAT via DLL sideloading, infecting at least 40 users.
1
Feedback Coding Enables Inference-Time Covert Agentic Communication
Researchers show black-box LLMs can hide messages in generated text with near-zero decoding error.
TerminalFix: PNG Steganography, (Mon, Sep 21st)
SANS analyzes the TerminalFix malware campaign, which hides a malicious DLL inside PNG pixel data via steganography and DLL side-loading.
2
Hackers Hide XMRig Miner in Windows Registry, PNG and WAV Files to Evade Detection
K7 Security Labs discovered a multi-stage Windows malware chain hiding an XMRig miner in the Registry, PNG, and WAV files.
3
PowerShell Malware Abuses Registry and DNS TXT Records to Deploy XMRig Crypto Miner
K7 Security Labs dissected a PowerShell cryptomining chain hiding payloads in registry, DNS TXT records, PNG pixels and WAV files to deploy XMRig.
4
Robust Coverless Linguistic Steganography via Sentence Embedding Space with Global Resynchronization
Researchers propose a coverless steganographic framework encoding messages as hierarchical clustering paths in sentence embedding space with a Global Resynchronization Mechanism for robustness.
Attack hides malware in PNGs and drops custom reverse tunnel on victims' machines
A ClickFix social engineering wave delivers a multi-stage attack that hides malware in PNG files and installs a custom reverse tunnel.
1
Cardinal RAT Sins Again, Targets Israeli Fin
Unit 42 documents updated Cardinal RAT attacks against Israeli FinTech firms, using BMP steganography, MD5-hash obfuscation, and process injection to hinder analysis and detection.
2