Malicious PNGs: What You See Is Not All You Get!
Summary: Cisco Talos analyzed a Graftor variant that appends a malicious DLL to the end of a valid PNG file, after the IEND tag, and downloads it in the background without user interaction. In the January sample, the malware requested toopu.png from 174.128.244.58, checked for a 200 OK response and a length of 269993 bytes, then loaded the embedded DLL at offset 3753; related samples also use khbgvkh.png and test.png, and some rewrite the hosts file to point antivirus vendor links to localhost.
Why it matters: The appended DLL is not obfuscated or hidden in any way, just attached after the IEND tag, and VirusTotal links toopu.png to over a thousand samples, so file-type checks that stop at the image boundary will pass it through. The test.png strings ActiveOfflineKeyLogger and UnActiveOfflineKeyLogger confirm the payload is built to capture keystrokes.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026