Steganography-Based Malware Campaign Uses Microsoft Office Exploit to Deliver AsyncRAT
Cybersecurity researchers have uncovered a stealthy malware campaign that cleverly disguises its malicious payload within seemingly harmless image files using steganography—a technique for concealing data inside multimedia content.
At the core of this attack is a known Microsoft Office vulnerability, CVE-2017-0199, first reported in April 2017. Exploited through phishing emails, this flaw enables the delivery of AsyncRAT, a remote access trojan that grants attackers full control over infected systems.
Anatomy of the Attack
The infection chain starts with phishing emails carrying malicious Microsoft Office documents. These files are engineered to exploit CVE-2017-0199, enabling the execution of a remote HTA script without any user interaction once the document is opened.
This script then downloads a trojanized version of Prnport.vbs, a legitimate Windows utility. When executed, the altered script launches a heavily obfuscated PowerShell payload designed to evade detection.
The PowerShell code retrieves an image file embedded with hidden malware. To the naked eye, it’s just a standard image—but buried within it is a malicious DLL injector.
Steganography in Action
What sets this campaign apart is its use of steganography to evade traditional detection mechanisms. The embedded DLL is encoded in Base64, concealed within the image’s pixel data and marked by custom delimiters (e.g., > and <). The PowerShell script scans the image, extracts the hidden payload, and executes it.
A Sophisticated, Multi-Stage Threat
According to researchers at Sophos, the campaign’s layered approach and innovative use of steganography make it particularly challenging to detect and neutralize.
“This attack demonstrates the continuing evolution of threat actors’ techniques,” said a Sophos analyst.
“By hiding malicious code within ordinary images, attackers can bypass many security solutions that don’t inspect image files for executable content.”
The extracted code uncovers a malicious DLL named Microsoft.Win32.TaskScheduler, which uses process hollowing to stealthily inject the AsyncRAT payload into a legitimate MSBuild.exe process.
By masquerading as a trusted Windows component, the malware is able to blend in with normal system activity, significantly complicating detection and analysis.
A key portion of the injector logic is reflected in this obfuscated PowerShell snippet:
The campaign’s endgame is the deployment of AsyncRAT, a powerful open-source remote access trojan that connects to command-and-control (C2) infrastructure at 148.113.214.176:7878.
Once installed, AsyncRAT grants attackers a wide range of capabilities, including remote desktop control, keylogging, and the ability to download and execute additional payloads—potentially including ransomware and other high-impact malware strains.
