Cybersecurity researchers have discovered a sophisticated malware campaign that employs steganography techniques to hide malicious code within seemingly innocent image files. This attack chain leverages an older Microsoft Office vulnerability (CVE-2017-0199) to ultimately deliver AsyncRAT, a remote access trojan capable of providing attackers with complete control over victim systems. Upon execution, the compromised Prnport.vbs file constructs and executes a complex PowerShell script that downloads an image file containing hidden malicious code. The attack begins with phishing emails containing malicious Microsoft Office documents designed to exploit CVE-2017-0199, a vulnerability first reported in April 2017. The extracted code reveals a DLL named “Microsoft.Win32.TaskScheduler” that employs process hollowing techniques to inject the AsyncRAT payload into a legitimate MSBuild process. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. The most innovative aspect of this attack involves the steganography technique used to hide the malicious injector DLL within a seemingly harmless image file. This PowerShell script looks innocent at first glance but contains multiple obfuscation techniques designed to evade detection. “This attack demonstrates the continuing evolution of threat actors’ techniques,” noted a Sophos analyst examining the campaign. This open-source remote access tool provides attackers with extensive capabilities including remote desktop access, keylogging, and the ability to deploy additional malware including ransomware. When the victim opens the compromised image, they see only an ordinary photograph, unaware that malicious code is hidden inside. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. Sophos researchers identified this campaign as particularly dangerous due to its multi-stage nature and use of steganography to avoid traditional security controls. The PowerShell script extracts this concealed code by locating specific Base64 markers (> and >) within the image’s data.
This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 24 Apr 2025 15:20:08 +0000