Back Cybersecuritynews

Hackers Leverage Steganographic Images to Bypass Anti

Cybersecuritynews •Tushar Subhra Dutta • February 24, 2026

A malicious NPM package named buildrunner-dev has been caught hiding .NET malware inside innocent-looking PNG images, using steganography to slip past antivirus tools and deliver a Remote Access Trojan onto Windows systems. Discovered in February 2026, this campaign signals a notable shift in supply chain attack methods, where the actual malicious code remains completely invisible inside what […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Malicious NPM Package Uses Steganography to Deliver .NET Malware A malicious NPM package named 'buildrunner-dev' has been discovered to hide .NET malware within PNG images using steganography, allowing it to evade antivirus detection. This attack targets software developers, leveraging a typosquatting technique to deceive users into downloading the harmful package. Upon installation, it executes a script that delivers a Remote Access Trojan to Windows systems. 2 sources 52

Extracted Entities

Hackers Leverage Steganographic Images to Bypass Anti

The full story

Extracted Entities

Attack Types (3)

MITRE ATT&CK (2)

Platforms (1)