Steganography is the practice of concealing data within other data so the hidden content is invisible to anyone not specifically looking for it. NIST defines it as "the art, science, and practice of communicating in a way that hides the existence of the communication." The critical distinction from encryption: encryption makes data unreadable but visible, while steganography makes it invisible entirely.
In cybersecurity, attackers use steganography to hide malicious payloads inside ordinary-looking files (images, documents, audio) to bypass security tools that scan for known threat signatures. MITRE ATT&CK documents two techniques: T1027.003 (hiding payloads during delivery) and T1001.002 (hiding command-and-control traffic post-compromise).
Three embedding techniques dominate modern campaigns:
A typical email attack chain: phishing email delivers a document or script dropper. The dropper downloads an innocuous-looking image from a legitimate hosting service (archive.org, image boards). The image contains a hidden payload that the dropper extracts and executes, establishing a remote access trojan, keylogger, or infostealer.
TA558 / SteganoAmor (2024). This campaign targeted 320+ organizations across Latin America using phishing emails with Office documents exploiting CVE-2017-11882. The documents triggered downloads of images containing Base64-encoded payloads that delivered Agent Tesla, Remcos RAT, FormBook, and XWorm.
Emotet and IcedID. Both malware families have used steganographic techniques to conceal payloads within image files delivered as secondary stages after initial email compromise, often in combination with conversation hijacking techniques for delivery.
APT29 (Operation Ghost). The Russian state-sponsored group employed steganography across multiple Duke-family malware variants for both payload delivery and command-and-control communications, embedding commands in images posted to public websites.
Security researchers have found that approximately 73% of steganography campaigns use finance-themed phishing emails, with Remcos RAT, Agent Tesla, and XWorm as the most common payloads.
Steganography is designed to evade detection, which makes identification challenging:
MITRE notes that steganography "cannot be easily mitigated with preventive controls since it is based on the abuse of system features." Defense must focus on behavioral detection of what happens after extraction rather than blocking the carrier files themselves.