The details come from the security site 2-spyware.com, which read its copy of the URLhaus data that day. This article separates what is reported from what is only inferred. Nobody has publicly analyzed the files themselves.
What URLhaus lists
The reporting identifies three HTTPS file URLs in the top-level directory of the site. Each is named img_ plus six digits and .png.
| File | Added | Tags | Status on 12 October |
|---|---|---|---|
| img_075144.png | 24 September 2026 | malware_download, AgentTesla, stego | Offline |
| img_095713.png | 24 September 2026 | malware_download, AgentTesla, stego | Offline |
| img_160619.png | 12 October 2026 | malware_download, rat, RemcosRAT, stego | Online |
The reporter on all three entries is listed as abuse_ch. The two September entries were added within one second of each other.
"Offline" only means URLhaus could not fetch the file at its last check. It doesn't say when the file went away, and it doesn't say the file was harmless.
What "stego" means and why PNGs
"Stego" is short for steganography, which is hiding data inside another file. MITRE ATT&CK defines the technique as a way to prevent detection of hidden information. MITRE's example is a 2017 case where a threat group used Invoke-PSImage to hide PowerShell commands in a .png file and run the code on a victim's system.
Security vendors give the practical reason. Many security controls allow image formats. Payloads embedded in images and hosted on image-hosting platforms or compromised websites can slip past those controls. A download that looks like a PNG, from an ordinary-looking company site, doesn't raise much suspicion.
A picture file like this is a carrier. It does not infect a PC just because someone views it. Something already running on the machine has to fetch the file, pull out the hidden part, and execute it. This is the general model, not a finding about these three files.
The two malware families
These are family-level descriptions from MITRE, not confirmed findings about the files on this host.
- Agent Tesla: MITRE describes it as a spyware Trojan written for the .NET framework, observed since at least 2014 and running on Windows. MITRE lists keylogging, screenshots, and credential theft from browsers, FTP clients and Wi-Fi profiles. It also lists the ability to download additional files. Its primary delivery route is email phishing.
- Remcos: MITRE calls it a closed-source tool marketed as remote control and surveillance software that has also been used in malware campaigns. Documented capabilities include keylogging, screenshots, webcam and microphone capture, file search and transfer, remote command execution, and use of the infected host as a SOCKS5 proxy. It has been spread through emails with malicious documents, including Excel files.
MITRE also records that Agent Tesla has dropped RegAsm.exe, a genuine Windows binary, and used process hollowing and injection. That is why a legitimate-looking process name in Task Manager doesn't clear a suspicious PC.
What is not known
The 2-spyware.com authors say they did not download the pictures. They therefore cannot say several things:
- what is inside the files;
- which malware build they carry;
- where any payload reports to;
- how the files got onto the host;
- which loader or message makes a victim's PC request them.
The site's home page answered a single plain request normally. It was a small company page built with SitePad. That proves nothing either way. A site that was misused or planted with files would normally still show a clean front page. The site owner may be an unwitting victim, or the site may have been set up for this. The evidence doesn't say which.
The author's remark that the pattern looks like someone swapping content on a hosting spot is the publisher's own reading of the dates. It is not a finding from any report.
What it means for Windows users and admins
If you only saw the name in a log. A firewall, DNS or proxy hit is an indicator to investigate. It isn't proof of infection. A person does not request img_160619.png by hand, so a hit suggests a program on that device made the request. Identify the device and the time first.
Triage steps for the device that asked:
- Record the timestamp, the device, the process if logged, and whether the transfer was blocked or completed.
- Check Windows Security under Virus & threat protection, then Protection history, for detections such as Remcos or Agent Tesla around that time.
- Review endpoint telemetry for suspicious activity. In Task Manager, look for RegAsm.exe running without reason or an unknown process with steady network use.
- Don't download the files onto a normal workstation.
- If the device ran something suspicious, stop using it for banking, email or work. Reset passwords and revoke sessions from a clean device, because a keylogger would also capture new passwords typed on the infected machine.
- Run a Microsoft Defender Offline scan, then consider a reset of Windows if you can't establish a clean state.
The source's author says this removal order is their own judgment from Windows menus and the sources, and they didn't test it on a live infection. A clean scan result is one data point and does not clear a PC.
Entry routes worth closing. MITRE says Agent Tesla has been delivered through Office flaws CVE-2017-11882 and CVE-2017-8570. Patched Office and Windows close those routes. Blocking or sandboxing suspicious email attachments, including Excel files, addresses the more common delivery paths.
Blocking at the perimeter. Admins can add the host and the three URLs to proxy or DNS blocklists and search historical logs for the filenames. MITRE notes that this technique can't easily be stopped with preventive controls because it abuses normal file features. Earlier and later detection matter more: stopping the first-stage program, and spotting the trojan and its outbound connections afterward.
If you run activegrp.co.za. Look in the top folder for img_ files with six digits and a .png ending that you didn't upload. Keep a copy and note the modification times before removing them. Their presence implies someone had write access, through a stolen hosting or FTP password, a weak admin login, or an outdated builder or plugin. Tell your host. A restore from a backup made before 24 September 2026, with all passwords changed, is safer than removing single files. The source did not read abuse.ch's current delisting procedure, so check it on abuse.ch directly.
The takeaway
This is a small, narrow indicator, not a headline campaign. Three URLs on one host carry malware tags, one was live at last check, and nobody has publicly confirmed the payloads. The value is in the logs: if those filenames or the domain appear in yours, treat that device as worth a proper look.