#steganography — Public Fediverse posts

Man I love everything about malware delivered by steganography. Way above my pay grade but I love it.

https://isc.sans.edu/diary/rss/33274

#malware #steganography

Boost for visibility..

Does this sound familiar to anyone? Like a recognizable encoding strategy? I can't shake the feeling that data is being encoded in this but I don't know how. I suspect this is for an ARG(Alternate Reality Game) and have already found data embedded in absurd places..

#steganography #audio #sigint #programming #radio

Phantom Stealer Malware Uses Steganography and Process Injection to Data Theft

Phantom Stealer is a .NET based information-stealing malware that uses
PNG steganography, PowerShell-based process injection and defense evasion techniques to steal browser credentials, cryptocurrency wallets, cookies and sensitive files. The malware also uses clipboard manipulation to redirect cryptocurrency transactions and employs multiple techniques to avoid detection.

Pulse ID: 6a82666881d78521845bd0af
Pulse Link: https://otx.alienvault.com/pulse/6a82666881d78521845bd0af
Pulse Author: cryptocti
Created: 2026-08-17 01:39:52

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Browser #Clipboard #Cookies #CyberSecurity #DataTheft #InfoSec #Malware #NET #OTX #OpenThreatExchange #PowerShell #Steganography #bot #cryptocurrency #cryptocti

thinking about the #huggingface hack and the new #ai watermarks.

pretty sure LLMs will start communicating via invisible watermarks as soon as they're smart enough to pull it off.

which means we'll be distributing their communication.

#steganography

does anyone have a link for @micahflee's talk that involved a proof of concept steganographic encrypted OS that hides in the filesystem of another OS? I need it for a blog post I'm writing
#encryption #steganography #qubes

Phantom Stealer Hides Inside PNG Files, Then Steals Your Passwords, Cookies and Crypto

Indicators extracted from public reporting. Source: https://www.splunk.com/en_us/blog/security/phantom-stealer-shellcode-steganography-credential-theft.html

Pulse ID: 6a7d94b079c2c1e42df7974b
Pulse Link: https://otx.alienvault.com/pulse/6a7d94b079c2c1e42df7974b
Pulse Author: CyberHunter_NL
Created: 2026-08-13 09:56:00

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Cookies #CyberSecurity #HTML #HTTP #HTTPS #InfoSec #OTX #OpenThreatExchange #Password #Passwords #RCE #ShellCode #Steganography #Word #bot #CyberHunter_NL

https://www.youtube.com/watch?v=fhoJK02oD_E

#steganography #BennJordan

There's so much cool stuff in this video. I want to repurpose some old android phones as audio messengers, and see what I can do with this on Meshtastic / LoRA... or what might sound like bird calls in the neighborhood. https://www.youtube.com/watch?v=fhoJK02oD_E #steganography #LoRA #Meshtastic

Phantom Stealer Unmasked: Shellcode, Steganography, and Credential Theft

Pulse ID: 6a701f541d329d7a88fa71bc
Pulse Link: https://otx.alienvault.com/pulse/6a701f541d329d7a88fa71bc
Pulse Author: Tr1sa111
Created: 2026-08-03 04:55:48

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #InfoSec #OTX #OpenThreatExchange #ShellCode #Steganography #bot #Tr1sa111

Steganography 101 by Benn Jordan

When our government is spying on everything we post, we probably will still need to hide stuff.

WIth good steganography, hidden messages in plain sight will survive also social media compression, spotify, etc.

https://www.youtube.com/watch?v=fhoJK02oD_E

#steganography #encryption #survival #fascism #autocracy #surveillance

Phantom Stealer Unmasked: Shellcode, Steganography, and Credential Theft

Phantom Stealer is a .NET-based credential-harvesting malware that collects browser credentials, saved passwords, session cookies, cryptocurrency wallet files, and system fingerprints from infected machines. Distributed through phishing emails, cracked software, and malicious links on Discord and Telegram, it employs multiple loader variants including steganography-based delivery and PowerShell shellcode injection. The malware uses extensive anti-analysis techniques including virtualization detection, API patching to disable AMSI and ETW, and timing-based sandbox evasion. It targets Chromium and Gecko-based browsers, cryptocurrency wallets, FileZilla credentials, WinSCP configurations, and Outlook profiles. Additional capabilities include keylogging, screen capture, clipboard monitoring with cryptocurrency address replacement, and Wi-Fi credential theft. The malware achieves persistence through registry Run keys or Startup folder entries.

Pulse ID: 6a6a0753fc3cdb9a380c795d
Pulse Link: https://otx.alienvault.com/pulse/6a6a0753fc3cdb9a380c795d
Pulse Author: AlienVault
Created: 2026-07-29 13:59:47

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Browser #Clipboard #CodeInjection #Cookies #CyberSecurity #Discord #Email #FileZilla #InfoSec #Mac #Malware #NET #OTX #OpenThreatExchange #Outlook #Password #Passwords #Phishing #PowerShell #RAT #ShellCode #Steganography #Telegram #WinSCP #Word #bot #cryptocurrency #AlienVault

Stegano 3.0.0 is out! 🎉

This release fixes silent corruption of Unicode messages (emoji, CJK, accented characters…) in the LSB image and WAV techniques: messages are now embedded as encoded bytes.

⚠️ The hidden-message format changed: payloads hidden with ≤ 2.5.0 must be hidden again.

Thanks to ~lechynte for the report and the initial patch!

https://github.com/cedricbonhomme/Stegano/releases/tag/v3.0.0

#Python #steganography #FOSS

From the archive! Steganography With Images In PHP

Steganography is the process of hiding data in plain sight. Instead of relying on encryption you simply create output or files that contain the hidden data, if you know what to look for.

In this article, Phil Norton looks at using PHP to hide messages in an image using steganography.

https://www.hashbangcode.com/article/steganography-images-php
#php #steganography #hashbangcode

Stegano 2.5.0 is out! 🎉

This release adds a reversible data hiding technique based on histogram shifting (Ni et al., IEEE TCSVT 2006): unlike LSB, the original cover image can be recovered pixel-for-pixel after the hidden message is extracted. Includes a new stegano-rdh command line tool.

Thanks to Eesh Saxena for the contribution!

https://github.com/cedricbonhomme/Stegano/releases/tag/v2.5.0

#steganography #Python #FOSS

In which #Anthropic tries to thwart Chinese LLM makers using sloppy #steganography in #ClaudeCode 🤦🏽‍♂️:

“Claude Code Is Steganographically Marking Requests”, ‘Thereallo’ (https://thereallo.dev/blog/claude-code-prompt-steganography).

On HN: https://news.ycombinator.com/item?id=48734373

#LLMs #Security #Privacy #AI #China

@MissConstrue

Probably you meant #steganography instead of stenography?

Though stenographers could certainly be employed in a steganographic attack, if there were stenographers any more (outside of courtooms).

Ok, to start, let me define "#steganography" in #infosec. Steganography in computer security is the practice of hiding information within another file, message, image, or video, making the concealed information undetectable to an unsuspecting observer.

It is not necessarily malicious, but it certainly can be. I tell you that story to tell you this one:

#Claude Code Is Steganographically Marking Requests

CC silently alters the system prompt using invisible-ish Unicode markers. It encodes proxy / gateway classification into a sentence that looks like plain English. It hides the domain list behind XOR and base64.

Is it malicious? Probably not. Is a pretty big marker on the "Why not to trust AI companies" list of reasons? Yeah, yeah it is.

https://thereallo.dev/blog/claude-code-prompt-steganography

#AI #security #ClaudeCode #Anthropic

(Edit: doh, fingers faster than brain)

Claude Code Is Steganographically Marking Requests

https://thereallo.dev/blog/claude-code-prompt-steganography

#HackerNews #ClaudeCode #Steganography #Requests #TechNews #AIResearch

I built this for learning purposes (I know JPEG steganography is not new, but I couldn't find much combining it with a multimodal LLM attack vector, so I thought why not?). Small C tool, LSB + spread spectrum where payload survives recompression.

https://github.com/FrancescoPaoloL/imgpoison

#infosec #llmsecurity #steganography

🕶️ Nouveau sur Merci.pics !

Cachez un message secret dans vos images ✨
• Watermark 🏷️
• Texte visible ✍️
• Stéganographie 🕶️
• Extraction 🔍

🔒 100% local · pas de cookies · pas de pub · pas de suivi
📷 Votre image ne quitte JAMAIS votre appareil

🗻 merci.pics/merci1.html

C'est gratuit. C'est silencieux. C'est respectueux. 🤍

#Privacy #Steganography #FrenchCulture #FreeTools #NoTracking #merci

What is covert channel amplification? I wrote a short blog post about it: https://wendzel.de/misc/2026/02/28/history-cc.html

#covertchannels #steganography #networksecurity #netsec #cybersec #cybersecurity #informationhiding #infosec #covertchannels #security

If you need some overview on how censorship is conducted or how it can be measured, here's our comprehensive paper on it:
https://www.sciencedirect.com/science/article/pii/S0167404825004213?via%3Dihub
We also summarized datasets and measurement platforms as well as selected human aspects.

#censorship #internetcensorship #censorshipcircumvention #freedomofspeech #infosec #cybersecurity #networks #internet #tcpip #selfcensorship #Tor #I2P #covertchannels #steganography #security #accessibility #gfw #china #vpn #ooni #gfwatch #censoredplanet #gfweb

Paper 2/2:

I know the idea is rather trivial but during Christmas I played around with IoT devices and how they can be used for censorship circumvention and time-decoupled covert transmissions.

AdullamoT: Using IoT Devices as Relays for Time-decoupled
Secret Exchange & Censorship Circumvention

PDF: https://wendzel.de/dr.org/files/Papers/AdullamoT.pdf

#censorship #internetcensorship #covertchannels #steganography #cybersecurity #infosec #iot

GPS numbers station: Navigation satellites have been broadcasting encrypted data for over a decade. Really neat analysis.
https://www.benthamsgaze.org/2026/06/02/the-quiet-numbers-station-decoding-nineteen-years-of-gps-cryptography/
#cryptopgraphy #steganography #via:lobsters #military #security #cool #gps #+

Porting SafeText and analyzing digital content with Apache Tika

Last year I wrote about pitfalls in modern journalism, especially with regards to receiving documents and information from whistleblowers without offering them adequate protection.

The tl;dr is that you, as a whistleblower, need to protect yourself; and you, as an editor or journalist, need to protect your whistleblowers.

Steganographic fingerprints might be one method adopted to detect someone leaking information. Steganographic characters replace common textual characters with unusual but hard to detect variants, e.g. they look the same to the human eye, or are actually invisible. Using a tool called SafeText by David Jacobson we can identify these hidden fingerprints in the content that you share.

I firmly believe we can find clues about what is important to preserve, or learn to preserve, when we analyse the content of the digital record and not just the (file) format of the digital record.

A file can contain many different features and these are all challenges to their future interpretation, and thus preservation.

I wanted to use SafeText in some of my other non-Python tooling and so I decided to port the code to Golang as a composable module and binary.

By coincidence at the time I started writing this I had also just written about revisiting tikalinkextract and so I thought I would write this small explanation about how you might combine Tika and SafeText to perform some content analysis of your own.

Who knows, maybe we will find a conspiracy. Maybe we’ll find secret codes in our own digital records. Maybe we’ll learn something new about our records…

Lets have a look at putting Tika and SafeText together and see where it goes.