Tricks and Treats: GHOSTPULSE’s new pixel-level deception

This Elastic Security Labs update documents a significant change to the GHOSTPULSE loader: instead of hiding encrypted payloads in PNG IDAT chunks, the malware now encodes configuration and payload data within image pixel RGB values and extracts it via GDI+ APIs. The report describes active campaigns delivering LUMMA STEALER through malicious social engineering (CAPTCHA-like prompts that execute PowerShell via clipboard/keyboard shortcuts), provides IOCs (SHA-256 hashes and domains), and supplies updated detection resources including YARA rules and a configuration extractor tool.