Identifying Possible Attack Vectors

Cyble Research Labs analyzes the rise of stegomalware — malware concealed inside image files — noting over 1,800 image-steganography-based samples in 90 days and recent incidents (including KNOTWEED and compromised Alibaba OSS buckets). The lab demonstrates that appending executables to JPGs (and pairing with SFX archives) can drastically lower antivirus detection (example: Agent Tesla detections fell from high to very low after embedding), outlines how this enables multistage attacks and process injection, and provides defensive recommendations and mapped MITRE techniques.