stego loader

The stego loader tag covers threats that use steganography to hide malicious payloads within seemingly benign files, such as images or system screens. In recent campaigns, attackers have weaponized fake Windows 11 update screens to trick users into executing commands that load in-memory steganographic payloads. These payloads deliver infostealers like LummaC2 and Rhadamanthys directly into memory, bypassing traditional file-based detection. The technique relies on social engineering via the ClickFix family, converting user actions into system compromise. Discussions focus on how stego loaders evade security tools and the specific indicators of compromise associated with these in-memory attacks.