When an Image Is More Than an Image

A PNG file normally feels harmless. A picture you open, view and move on from. But attackers are increasingly using that assumption against defenders.

A recent campaign involving Phantom Stealer hides malicious code inside PNG images, allowing the malware to be delivered while appearing to be an ordinary image file. The technique combines steganography, shellcode and in-memory execution to make the attack harder to detect.  

Threat Overview

Phantom Stealer is an information-stealing malware (infostealer). Instead of encrypting files or immediately disrupting a computer, its job is to quietly collect valuable information from an infected device.

This can include browser credentials, cookies and session information, financial data, screenshots and other sensitive information. Recent reporting also shows Phantom Stealer campaigns using heavily obfuscated, fileless execution—meaning much of the malware operates in memory rather than being saved as a conventional executable on disk.  

That makes the campaign particularly interesting from a defensive perspective given that the attack is designed to make both the payload and its execution difficult to spot.

The Attack Chain

Phishing lure → Malicious script → PNG downloaded → Hidden payload extracted → Shellcode executed in memory → Phantom Stealer harvests credentials/cookies → Data exfiltrated

The attack begins with a phishing lure, such as a fake request-for-quote document, designed to trick the victim into executing a malicious file or script. The malware then retrieves a seemingly harmless PNG image containing a hidden payload. Through steganography, malicious data is concealed within the image’s pixels without visibly altering the picture.

A .NET-based loader extracts the hidden data and uses XOR decoding to reconstruct the shellcode, the code responsible for executing the malicious activity. The shellcode is then Donut-packed and injected into a legitimate process such as explorer.exe, allowing Phantom Stealer to operate largely in memory and reduce traditional file-based detection.

Once active, Phantom Stealer harvests browser credentials and session cookies, which can potentially provide attackers with access to already-authenticated accounts. The stolen information is subsequently exfiltrated through channels including Telegram, Discord, FTP, and SMTP, completing the attack chain.

Why It Matters

This campaign demonstrates why "the file isn't an EXE" is no longer a useful safety test.

An image, document or archive can simply be the delivery vehicle for something much more dangerous. More importantly, an infostealer infection can have consequences beyond the compromised computer: stolen credentials and session cookies can provide attackers with access to corporate applications, cloud services and other accounts.

For organizations, the focus should therefore extend beyond detecting malware files to identifying suspicious script execution, abnormal process behavior, browser credential access and unexpected outbound communication.

Recommendations

Organizations should:

• Monitor and Restrict execution of unauthorized scripts such as PowerShell and Windows Script Host where business requirements allow.

• Inspect suspicious image files and investigate unexpected downloads of PNGs from untrusted infrastructure.

• Protect browser credentials and restrict unnecessary browser synchronization.

• Use EDR capable of detecting memory-based execution and process injection.

• Monitor outbound connections to unusual Telegram, Discord, FTP or SMTP infrastructure.

• Educate users that a familiar-looking document or image can still be part of a malware delivery chain.

‍