RuntimeRebel — #SteganographyCybersecurity articles tagged #Steganography on RuntimeRebel.https://runtimerebel.comDOUBLECUP Malware: Appended PowerShell Payloads in PNG Fileshttps://runtimerebel.com/blog/doublecup-malware-appended-powershell-payloads-in-png-fileshttps://runtimerebel.com/blog/doublecup-malware-appended-powershell-payloads-in-png-filesAnalysis of DOUBLECUP malware reveals a deceptive technique: appending cleartext PowerShell payloads to PNG image files, bypassing traditional steganography.Mon, 24 Aug 2026 08:39:29 GMTMalwarePowerShellSteganographyThreat IntelligenceDOUBLECUPNorth Korean Actors Use SVG Steganography to Deliver OtterCookiehttps://runtimerebel.com/blog/north-korean-actors-use-svg-steganography-to-deliver-ottercookiehttps://runtimerebel.com/blog/north-korean-actors-use-svg-steganography-to-deliver-ottercookieNorth Korean threat actors are hiding OtterCookie malware in SVG flag images within fake coding tests to target developers and steal cryptocurrency.Fri, 17 Jul 2026 17:13:52 GMTLazarus GroupOtterCookieContagious InterviewSteganographyNode JsInfostealerGhostcommit: Hidden Prompt Injection in Images Targets AI Agentshttps://runtimerebel.com/blog/ghostcommit-hidden-prompt-injection-in-images-targets-ai-agentshttps://runtimerebel.com/blog/ghostcommit-hidden-prompt-injection-in-images-targets-ai-agentsResearchers demonstrate Ghostcommit, a technique using images to hide prompt injection attacks that trick AI agents into exfiltrating repository secrets.Sat, 11 Jul 2026 09:39:43 GMTGhostcommitPrompt InjectionSteganographyAI SecurityCoderabbitBugbotMicrosoft Pulls 119 Malicious StegoAd Edge Extensionshttps://runtimerebel.com/blog/microsoft-pulls-119-malicious-stegoad-edge-extensionshttps://runtimerebel.com/blog/microsoft-pulls-119-malicious-stegoad-edge-extensionsMicrosoft removes 119 Edge extensions linked to the StegoAd campaign, which used steganography in images and fonts to steal credentials and commit ad fraud.Mon, 29 Jun 2026 09:51:08 GMTMicrosoft EdgeStegoAdBrowser SecuritySteganographyAdwareMSI-Branded Image Steganography: Analysis of WeTransfer Phishinghttps://runtimerebel.com/blog/msi-branded-image-steganography-analysis-of-wetransfer-phishinghttps://runtimerebel.com/blog/msi-branded-image-steganography-analysis-of-wetransfer-phishingAnalysis of a recurring phishing campaign using steganography in MSI-branded images to deliver malicious payloads via WeTransfer links and bypass security.Fri, 05 Jun 2026 09:19:42 GMTSteganographyPhishingWeTransferMalicious ImagesMSI BrandingWordPress Sites Targeted by Malware Using Steam Profile Dead-Dropshttps://runtimerebel.com/blog/wordpress-sites-targeted-by-malware-using-steam-profile-dead-dropshttps://runtimerebel.com/blog/wordpress-sites-targeted-by-malware-using-steam-profile-dead-dropsOver 2,000 WordPress sites compromised in a campaign hiding C2 resolution data within Steam Community profiles. Technical breakdown of the evasion tactics.Mon, 01 Jun 2026 18:06:43 GMTWordPressSteam CommunityC2 EvasionSteganographyMalware AnalysisLLM Text-in-Text Steganography: Emerging Covert Channel Riskshttps://runtimerebel.com/blog/llm-text-in-text-steganography-emerging-covert-channel-riskshttps://runtimerebel.com/blog/llm-text-in-text-steganography-emerging-covert-channel-risksAnalysis of how Large Language Models enable sophisticated text-in-text steganography for covert communication, data exfiltration, and C2 operations.Mon, 11 May 2026 13:11:36 GMTLLMSteganographyData ExfiltrationAI SecurityCovert ChannelsMalware Delivery via Malicious .WAV Files — Technical Analysishttps://runtimerebel.com/blog/malware-delivery-via-malicious-wav-files-technical-analysishttps://runtimerebel.com/blog/malware-delivery-via-malicious-wav-files-technical-analysisSecurity analysts identify .WAV audio files being used to hide malicious payloads. Learn how steganography allows attackers to bypass perimeter security.Tue, 21 Apr 2026 08:45:41 GMTSteganographyWav MalwarePowershell ObfuscationAPT32Malware DeliveryBackdoored Telnyx PyPI Package Uses Steganography to Deliver Malwarehttps://runtimerebel.com/blog/backdoored-telnyx-pypi-package-uses-steganography-to-deliver-malwarehttps://runtimerebel.com/blog/backdoored-telnyx-pypi-package-uses-steganography-to-deliver-malwareSecurity researchers discovered malicious versions of the Telnyx PyPI package delivering infostealers via steganography hidden in WAV audio files.Sat, 28 Mar 2026 00:36:31 GMTPyPITelnyxSteganographyInfostealerTeamPCPPython SecurityTelnyx PyPI Package Compromised by TeamPCP via Steganographyhttps://runtimerebel.com/blog/telnyx-pypi-package-compromised-by-teampcp-via-steganographyhttps://runtimerebel.com/blog/telnyx-pypi-package-compromised-by-teampcp-via-steganographyTeamPCP threat actors distributed malicious Telnyx Python package versions 4.87.1 and 4.87.2 on PyPI to harvest credentials using hidden WAV files.Fri, 27 Mar 2026 20:15:00 GMTTelnyxPyPITeamPCPPythonSteganographyCredential Theft