Caminho Malware Loader Conceals .NET Payloads inside Images via LSB Steganography

Cybersecurity researchers at Arctic Wolf Labs have identified a new threat named Caminho, a Brazilian Loader-as-a-Service (LaaS) utilizing images to distribute malware.

Active since March 2025, this operation conceals .NET payloads through Least Significant Bit (LSB) steganography within files hosted on trusted sites such as archive.org.

This technique enables attackers to bypass defenses by embedding remote access tools and infostealers, targeting businesses in South America, Africa, and Eastern Europe.

The attack initiates with spear-phishing emails containing social engineering tactics, like fake invoices or urgent quotes, disguised as RAR or ZIP archives with JavaScript or VBScript files.

These scripts retrieve obfuscated PowerShell code from pastebin services like paste.ee, which then downloads images from legitimate archives.

Embedded within these JPG or PNG files is a .NET loader called Caminho, extracted using LSB steganography that modifies the least significant bits of pixel colors to encode malicious data without changing the image's appearance.

The PowerShell script scans for a unique byte signature in the image, extracts the embedded payload, and loads it directly into memory, bypassing disk writes to evade antivirus scans.

The loader then injects the final malware into benign processes like calc.exe while establishing persistence through scheduled tasks that rerun the chain every minute.

This fileless method, combined with anti-analysis techniques like VM detection and debugger checks, makes Caminho difficult to detect. Researchers analyzed 71 samples, all heavily obfuscated but consistently featuring Portuguese strings and a HackForums namespace, indicating a modular design built for reuse.

Loader-as-a-Service Facilitates Payload Variety

Caminho distinguishes itself with a business model that allows operators to rent the loader for custom malware delivery, accepting any URL as an argument for flexibility.

Observed payloads include the REMCOS RAT for remote control, XWorm, and Katz Stealer, a credential grabber first noted in May 2025.

The same steganographic images appear across different campaigns, confirming this rental model and explaining the payload diversity.

Infrastructure combines legitimate platforms for staging—archive.org for images, paste sites for scripts—with resilient C2 servers on providers like Railnet LLC, known for avoiding takedowns.

Attribution links Caminho to Brazil due to the use of Portuguese code in variables, errors, and comments, as well as targeting that begins in South America and peaks during local business hours.

Victims include industries in Brazil, South Africa, Ukraine, and Poland, with geographic expansion accelerating post-June as steganography advanced the operation.

This is financially motivated cybercrime, exploiting trusted sites to challenge conventional blocks without affecting legitimate traffic.

Experts recommend layered defenses such as sandboxing attachments, PowerShell logging, and AI-driven EDR to detect behavioral anomalies as threats like Caminho continue to evolve.

Caminho illustrates the mainstream use of steganography in evading detection. With the campaign still active into October 2025, organizations must remain vigilant against these hidden threats.

Based on reporting by GBHackers.