Your security team scans email attachments. Your firewall blocks known malicious file types. Your employees know not to open .exe files from strangers. So attackers started hiding inside the files nobody suspects: the humble PNG image.

An image is just pixels, right? Wrong. A PNG file is a structured container - and criminals have become very creative about what they put inside it.

How attackers weaponize image files:

🎨 Steganography - malware hidden in plain sight - Steganography is the art of hiding data inside other data. Attackers embed malicious code, configuration files, or encryption keys within the pixel data of a PNG. The image displays normally. Security scanners see a valid image. Meanwhile, a hidden payload executes in the background. This technique has been used by nation-state actors and cybercrime groups to deliver second-stage malware while evading detection.^[ref]

🖼️ PNG polyglots - files that are two things at once - A polyglot file is valid in two or more formats simultaneously. An attacker can craft a file that is a valid PNG and a valid ZIP archive, HTML file, or JavaScript payload. Security tools see a PNG. The vulnerable parser sees something else entirely.^[ref]

📦 Malicious code in image metadata - PNG files contain metadata chunks (EXIF, tEXt, iTXt). Attackers embed obfuscated scripts, shellcode, or C2 URLs in these fields. The visible image is benign. The metadata payload is not.

🔌 VS Code and developer tool exploitation - Malicious VS Code extensions load what appears to be a PNG image, then extract and execute hidden code from within it. The IDE sees a resource file. The security tool sees an image. The developer machine executes malware.^[ref]

🌐 Malicious images from legitimate infrastructure - Attackers host malicious PNG files on trusted cloud storage (AWS S3, Google Cloud, Azure). Security tools relying on domain reputation allow the download. The image arrives clean-looking from a trusted source.

📧 Image-based phishing bypass - Phishing emails containing only images bypass text-based spam filters. A PNG screenshot of a convincing message with a QR code directs victims to phishing sites. No text to scan. No link to detect. Just an image.

APT groups have used PNG steganography to deliver remote access trojans (RATs) to government and financial sector targets.^[ref] The SolarWinds supply chain attack - one of the most significant of the decade - used image-based steganography as one of its evasion techniques.

What can we do:

For individuals:

- Be cautious of emails with image-only bodies directing you to scan a QR code or visit a link.

- Avoid downloading images from unknown sources and opening them with unexpected applications.

For organizations:

- Deploy EDR solutions that monitor process behavior, not just file signatures. Steganographic malware may arrive as a clean image but exhibit unusual behavior when processed.

- Scan for anomalies in image files at email gateway and web proxy - oversized images, unusual metadata, and unexpected entropy patterns are red flags.

- Apply strict application allowlisting - limit which processes can read and execute data from downloaded files.

- Review developer tools and build pipelines for unsigned or unverified extensions that load external resources.

The most dangerous file isn't always the one that looks dangerous.