Caminho Loader-as-a-Service Uses Steganography for Malware Delivery

Cybersecurity researchers have identified a new threat called Caminho, a Loader-as-a-Service (LaaS) that hides .NET payloads within images using Least Significant Bit (LSB) steganography. Active since March 2025, this operation targets businesses across multiple regions. The attack begins with spear-phishing emails containing JavaScript or VBScript files, which fetch obfuscated PowerShell code to extract the malicious payload from images hosted on trusted sites. The loader injects the final malware into benign processes and sets up persistence through scheduled tasks. This fileless approach, combined with anti-analysis tricks, makes Caminho difficult to detect.