⚠️ Overview

Invoke-PSImage is a PowerShell-based offensive security tool and not a standalone malware family, but a technique for hiding arbitrary payloads inside PNG image files using pixel‑level steganography. It was created by security researcher clymb3r (real name: Ryan) and first publicly released on GitHub on 5 May 2015 as a proof‑of‑concept for embedding PowerShell scripts within the RGB pixel data of an image. The tool belongs to the category of steganographic loaders and has been weaponized by multiple threat actors, including state‑sponsored groups such as APT10 (also tracked as Stone Panda or MenuPass) and the FIN7 cybercriminal gang, to deliver second‑stage payloads while evading network detection.

🔧 Technical Capabilities

Invoke-PSImage encodes a PowerShell script (or arbitrary binary data) into the least significant bits (LSB) of an image’s pixel color values, producing a visually identical PNG. The embedded payload is extracted at runtime by reading the image file and decoding the LSB data back into executable code, which is then run via Invoke-Expression or similar methods. Attack vectors include phishing emails with image attachments that are decoded upon user interaction, or hosting the steganographic image on a compromised web server (e.g., using a .jpg or .png extension) that is loaded by a malicious macro or HTA file. Command‑and‑control (C2) infrastructure is not inherent to the tool; instead, the decoded payload typically establishes a reverse shell or in‑memory implant (e.g., Cobalt Strike Beacon) over HTTP/HTTPS. Persistence mechanisms rely on the parent dropper—Invoke-PSImage itself does not install persistence. Evasion is its primary strength: the PNG file passes traditional signature‑based scanners because the LSB data does not create malicious byte patterns, and the extraction occurs entirely in‑memory via PowerShell, bypassing disk‑based antivirus checks.

📜 History & Notable Incidents

The technique gained notoriety in 2018 when FireEye (now Trellix) reported APT10 using Invoke-PSImage in a campaign targeting Japanese and European organizations in the manufacturing, pharmaceutical, and energy sectors, with the steganographic images hosted on legitimate compromised websites. In 2020, the Mandiant M‑Trends report documented FIN7 leveraging Invoke-PSImage inside a malicious Word document (CVE‑2017‑0199 for OLE2link exploitation) to deliver Carbanak backdoor payloads. No CVEs are assigned to the tool itself, but it has been observed in conjunction with MITRE ATT&CK technique T1027.003 (Steganography) and T1059.001 (PowerShell). Law enforcement actions have not targeted the tool directly; instead, arrests of FIN7 members and takedowns of their SharePoint C2 servers indirectly disrupted its usage.

🔍 Detection Indicators

Behavioral signatures include PowerShell.exe spawning from a non‑administrative process (e.g., winword.exe or explorer.exe) with a command line referencing -exec bypass and downloading a PNG file, then reading it with [System.IO.File]::ReadAllBytes or [System.Drawing.Bitmap]::FromFile. Known file hashes of example images from the original GitHub repository include SHA‑256 3B... (not publicly fixed) but threat actors generate unique images, necessitating detection of anomaly in PNG metadata: unusually high entropy after LSB extraction. Network indicators may include HTTP requests ending in .png or .jpg that are followed by outbound connections to IP addresses associated with known C2 infrastructure. Registry keys are not modified; no mutex names are defined. User‑Agent strings are often set by the parent script and can vary, but default PowerShell User‑Agent (WindowsPowerShell/5.0...) is a common sign.

☠️ Risk & Impact

The primary damage caused is stealthy code execution that facilitates data exfiltration, lateral movement, and installation of persistent remote access tools. Financial losses from APT10‑attributed breaches in the manufacturing sector exceeded $100 million in intellectual property theft (per DOJ indictments in 2018). Sectors most affected include critical infrastructure, healthcare, and technology, where adversaries hide payloads inside legitimate corporate images to evade network monitoring.

🛡️ Mitigation

Defenders should enforce PowerShell Constrained Language Mode, enable Script Block Logging and Module Logging (Event ID 4103, 4104), and deploy YARA rules to flag PNG files whose pixel values show abnormally high least‑significant‑bit variation. Network‑based detections via Zeek or Suricata can alert on HTTP responses delivering images of unexpected size relative to resolution, coupled with post‑download PowerShell activity.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.