Mal Ghostposter Steganography Marker V1

Tim Peck@timpeck

•updated Dec 19, 2025•6•1•103

Detects PNG files containing a steganographic marker ('===') used by the GhostPoster malware campaign to hide a JavaScript payload. This technique was observed in malicious Firefox browser extensions.