Caminho Loader-as-a-Service Uses LSB Steganography to Hide .NET Payloads in Archive.org Images

Caminho Loader-as-a-Service uses Least Significant Bit steganography to conceal .NET payloads inside image files hosted on Archive[.]org, according to Arctic Wolf. The operation has been active since March 2025, with notable evolution in June 2025 when operators began embedding payloads within images hosted on archive[.]org, a legitimate non-profit hosting service.

It is described as a Brazilian-origin Loader-as-a-Service that delivers a variety of malware and infostealers, including REMCOS RAT, XWorm and Katz Stealer, to victims across multiple industries in South America, Africa and Eastern Europe. The infection chain starts with spear-phishing emails delivering JavaScript or VBScript files compressed in RAR or ZIP archives, which fetch obfuscated PowerShell payloads from pastebin-style services that then download steganographic images from archive[.]org.

Those images conceal the .NET payloads loaded directly into memory, bypassing disk-based antivirus detection, with persistence established via scheduled tasks. The operation rents its loader infrastructure to other threat actors, using a standardised interface to allow different payloads and customers to deploy campaigns via the same delivery infrastructure.