TA558 Hackers Weaponize Images for Wide-Scale Malware Attacks

TA558 (campaign codename SteganoAmor) is leveraging steganography—embedding obfuscated VBS, PowerShell, and exploit-laden documents inside images and text files—to deliver a range of malware (Agent Tesla, FormBook, Remcos RAT, LokiBot, GuLoader, Snake Keylogger, XWorm) via phishing emails that exploit CVE-2017-11882; attacks have targeted industrial, services, electric power and construction sectors across Latin America and other countries, using compromised SMTP/FTP and paste/image hosting for payload staging and data exfiltration.