Loader Reads PNG File Then Spawns Process (IDAT-Chunk Payload Extraction)

Ibrahim Saud@tektrix

•updated Jul 3, 2026•0•0•0

Detects instances where an unusual process (not a standard image viewer or web browser) reads a .png file and subsequently triggers a new process within a 5-minute window. This behavior is indicative of potential steganographic exploitation or hiding malicious code within image files, where a hidden payload is read and then executed.