Hackers Leverage Steganographic Images to Bypass Anti-Malware Scans and Deploy Malware Payloads
A malicious NPM package named buildrunner-dev has been identified as concealing .NET malware within PNG images through steganography, enabling it to bypass antivirus detection and deliver a Remote Access Trojan (RAT) to Windows systems.
A malicious NPM package named buildrunner-dev has been identified as concealing .NET malware within PNG images through steganography, enabling it to bypass antivirus detection and deliver a Remote Access Trojan (RAT) to Windows systems.
This campaign, discovered in February 2026, highlights a significant evolution in supply chain attack tactics, whereby the malicious code is hidden within what appears to be a standard image file.
The package was designed as a typosquat of the legitimate buildrunner and build-runner NPM packages, which had been abandoned by their creators. Developers seeking the original package might mistakenly install this malicious version, mistaking it for an updated release.
Upon installation via npm install , the post-installation script automatically executes a file named init.js , which downloads a batch file named packageloader.bat from a Codeberg repository. This file then copies itself to the Windows Startup folder, ensuring automatic execution upon each login.
Veracode analysts uncovered the complete attack chain after deconstructing seven layers of obfuscation within the batch file, which contained 1,653 lines but only approximately 21 lines of functional instructions. The remaining lines were filled with noise, consisting of random comments, fake base64 strings, and junk variables designed to mislead both static analysis tools and human reviewers.
Prior to executing its payload, the malware verifies administrative privileges and silently elevates its permissions using the fodhelper.exe UAC bypass technique (MITRE ATT&CK T1548.002), avoiding any visible prompts.
The malware then initiates a concealed PowerShell session through conhost.exe , queries the system for installed antivirus products, and adapts its infection path accordingly. The final payload is Pulsar , a well-known open-source RAT, injected into a legitimate Windows process using process hollowing.
The package was designed as a typosquat of the legitimate buildrunner and build-runner NPM packages, which had been abandoned by their creators.
Two PNG images hosted on ImgBB contained the hidden malware. The image 6b8owksyv28w.png (41×41 px, 2.3 KB) held a 4,903-byte AMSI bypass PowerShell script, while 0zt4quciwxs2.png (141×141 px, 67 KB) contained a compressed 136 KB .NET loader.
The malware encoded these payloads directly into the RGB pixel values of each image, making them appear as random visual noise to scanning tools.
A third steganographic PNG at hxxps://i.ibb[.]co/tpyTL2Zg/s9rugowxbq8i.png functioned as the live C2 channel, delivering the final encrypted Pulsar RAT payload as needed.
Type Indicator
Malicious NPM Package buildrunner-dev
C2 Steganographic Image URL hxxps://i.ibb[.]co/tpyTL2Zg/s9rugowxbq8i.png
Dropped Batch File packageloader.bat
Persistence File %AppData%\protect.bat
Dropped Executable JJYDJO.exe
Security teams are advised to audit NPM packages prior to installation, disable automatic execution of post-install scripts, and monitor for unusual PowerShell activities. Additionally, vigilance for UAC bypass registry modifications and unexpected outbound connections to image hosting services can help detect similar attacks before they cause significant damage.
Based on reporting by Cyber Security News.