Hackers Use Steganographic Images to Bypass Anti-Malware and Deploy Malware

Hackers are abusing steganography in PNG images to smuggle a Pulsar Remote Access Trojan (RAT) into Windows systems through a malicious NPM package named buildrunner‑dev. The attack starts with a typosquatted NPM package, buildrunner‑dev, which impersonates the abandoned “buildrunner”/“build-runner” tools to catch developers who mistype or assume it is a maintained fork. Its package.json looks harmless but defines a postinstall hook that automatically runs init.js whenever someone executes npm install. Rather than bundling malware directly, init.js acts as a downloader: it retrieves a heavily obfuscated packageloader.bat from a Codeberg repository at install time, keeping the NPM package itself mostly clean. package.json — buildrunner-dev (Source : Veracode). The campaign combines supply‑chain abuse, multi‑layer obfuscation, AMSI bypasses, and process hollowing to gain full remote control over developer machines quietly. The script writes the batch file to the Windows Startup folder under a randomized name, ensuring it runs on the next user logon, and deliberately skips execution on non‑Windows platforms, in CI environments, or when a debugger is attached. Variable names like telemetryEndpoint and traceToken are chosen to look like benign analytics telemetry and avoid suspicion during casual review. Despite being 1,653 lines long, the batch file contains only about 21 meaningful lines; the rest are padded with random REM comments, junk SET commands, fake base64, and oversized strings to mislead analysts and static scanners. The script first copies itself to %AppData%\protect.bat for persistence, then checks for administrator rights and invokes a fodhelper.exe‑based UAC bypass (MITRE T1548.002) to relaunch itself with elevated privileges without triggering a UAC prompt. Once elevated, it concatenates 900+ variable fragments into a single hidden conhost.exe –headless powershell.exe -ep bypass -w h -c “…” command that launches the next stage PowerShell payload. PNG Steganography and AMSI The PowerShell stage profiles installed antivirus via WMI and adjusts its behavior per product, using different payload images and AMSI bypass logic for ESET, Malwarebytes, F‑Secure, Avast, and generic environments. The smaller image (41×41 pixels, 2.3 KB) contains a 4,903-byte PowerShell script, itself obfuscated with character-by-character concatenation. Extracting the Payloads (Source : Veracode). It then downloads what appear to be ordinary PNG files from i.ibb[.]co, a free image‑hosting service, and uses a custom steganographic routine to extract embedded data from RGB pixel values. In this scheme, the first two pixels encode the payload size as a 32‑bit integer, while all subsequent pixels store three bytes of payload each across their red, green, and blue channels, read sequentially left‑to‑right, top‑to‑bottom. One 41×41 PNG yields an obfuscated PowerShell script that patches AMSI in memory using dynamically emitted .NET delegates, GetProcAddress, and VirtualProtect, forcing AmsiScanBuffer to always return an error code and effectively disabling script scanning. A second, larger 141×141 PNG decodes to a GZip‑compressed 64‑bit .NET executable that acts as a sophisticated process‑hollowing loader with additional AMSI bypasses and encryption‑based payload protection. Inside the .NET loader, three AMSI bypass techniques operate in sequence: scanning amsi.dll to neutralize the AmsiScanBuffer pattern, a hardware breakpoint + Vectored Exception Handler trick that fakes clean scan results, and a classic direct patch that overwrites the function with NOPs and a RET instruction. All sensitive APIs such as VirtualProtect and AddVectoredExceptionHandler are resolved dynamically by parsing module export tables and using a custom hashing function, leaving the import table free of suspicious names that traditional static detection often relies on. Pulsar RAT Delivery The loader implements 64‑bit process hollowing, creating a legitimate Windows process (such as conhost.exe) in a suspended state, unmapping its original code, and injecting decrypted malware into the now‑empty address space before resuming execution. It chains multiple layers of protection around the final payload, using base64 encoding, AES/TripleDES encryption with SHA‑256‑derived keys, and GZip compression so that no cleartext binary ever touches disk. Decrypted configuration strings reveal steganographic command‑and‑control (C2) URLs on i.ibb[.]co, scheduled task commands for persistence, mutex names for single‑instance control, and references to AV products like Avast to steer custom persistence code paths. A third stego PNG, fetched at runtime, hides yet another encrypted .NET assembly that ultimately decompresses into Pulsar, a powerful Quasar‑derived Windows RAT known for fileless execution, HVNC‑style stealth remote desktop, credential theft, and extensive spying capabilities. By blending NPM typosquatting, multi‑stage steganography, AMSI evasion, and process hollowing, the attackers achieve a stealthy supply‑chain compromise that can silently turn developer endpoints into fully controlled Pulsar RAT footholds. Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.

Based on reporting by GBHackers.