Caminho Malware Loader Conceals .NET Payloads inside Images via LSB Steganography

Caminho is a Brazilian Loader-as-a-Service (LaaS) that conceals .NET payloads inside images using Least Significant Bit steganography, turning ordinary JPG or PNG files into carriers for malware. Active since March 2025 and evolving rapidly by June, the operation hides the payloads in images hosted on trusted sites such as archive[.]org, with a PowerShell script fetching obfuscated code from pastebin services before extracting the loader.

According to Arctic Wolf Labs, the loader then loads the payload into memory, avoiding disk writes to evade antivirus scans, and injects the final malware into benign processes like calc.exe while establishing persistence via scheduled tasks that rerun the chain every minute. Observed payloads include REMCOS RAT, XWorm, and Katz Stealer, with the same steganographic images reappearing across campaigns to support a modular, rental model.

High-confidence attribution points to Brazil, and victims span Brazil, South Africa, Ukraine, and Poland, with activity accelerating after June 2025 as the technique matured. Organizations are urged to implement layered defenses, including PowerShell logging and AI-driven EDR, to detect the hidden chains used by Caminho.