Pixel perfect Ghostpulse malware loader hides inside PNG image files

Ghostpulse, a loader active since 2023, has been updated to embed and reconstruct its encrypted configuration and payload within PNG image pixels by extracting RGB bytes, validating 16‑byte blocks via CRC32, and XOR‑decrypting the result; this makes detection harder. Operators distribute it using social‑engineering (fake CAPTCHA that copies malicious JavaScript to the clipboard and a PowerShell dropper) to deliver payloads such as the Lumma infostealer, and vendors (Elastic, McAfee) have released or updated detections and YARA rules to counter it.