HijackLoader IDAT Steganography: PNG Chunks Hidden in Disguised File

Ibrahim Saud@tektrix

•updated Jul 3, 2026•0•0•9

Detects the presence of HijackLoader/IDAT Loader payloads disguised as non-PNG files. The rule identifies files containing concatenated PNG IDAT chunks that do not start with a valid PNG magic header, followed by a canonical IEND terminator, characteristic of steganographic data storage used to deploy the HijackLoader toolkit.