PowerShell Steganography Payload Extraction from CDN

Kaung Khant Ko@kaungkhantko

•updated Jan 27, 2026•36•3•231

Detects PowerShell scripts attempting to perform image steganography by loading System.Drawing assemblies and calling functions like GetPixel or LockBits to extract data. This technique was observed in an Amatera Stealer campaign where payloads were hidden in PNG files hosted on public CDNs.