Type to search across the blog, guides, tools, and services.
↑↓
to navigate
↵
to open
Technique
Hackers hide malware in pictures
SANS Internet Storm Center covered this technique on Sep 21, 2026. Below is a plain-English breakdown of what it is, how it actually works, and whether it matters, written for people who are curious about hacking and security but don't have a technical background.
SANS Internet Storm Center · Sep 21, 2026
In plain words
Imagine you are sending a secret message to a friend inside a picture, so nobody else knows what it says. This is similar to what some hackers do with a technique called steganography¹. They hide malicious code or data inside an image file, like a PNG picture, so it looks harmless but can actually do bad things when opened or processed by a computer.
How it actually works
The hackers in this case used PNG files with steganography to hide their malware, which is a type of malicious software. This allowed them to sneak the malware past security checks and into the target computer system. The malware then set up a reverse tunnel², which is like a secret backdoor that lets the hackers access the system remotely.
Terms
¹ steganography
, Steganography is a way of hiding secret information or messages inside other files, like images or videos, so it is not visible to others.
² reverse tunnel
, A reverse tunnel is a type of connection that allows hackers to access a system remotely, often without being detected by security software.
Learn the fundamentals
Want to understand the concepts behind this item? These in-depth HackproofHacks guides explain the
underlying techniques from the ground up.
KeepLooped tracks the newest
offensive-security tools, techniques, vulnerabilities and research from 80+ trusted sources and turns the
most important items into plain-language explainers, so people learning security can keep up without a
technical background. This page summarises and explains the source linked below; it was produced with AI
assistance and is meant as a beginner-friendly starting point. Always confirm specifics, versions, CVE
details, and exploitation status, against the original source and official advisories. Curated and
published by HackproofHacks.