Researchers find malware operators are now using steganography techniques to hide malicious code in WAV audio files
Steganography malware trend moving from PNG and JPG to WAV files. — Two reports published in the last few months show that malware operators are experimenting with using WAV audio files to hide malicious code.
Context & Ripple Effects
Two reports published within months of each other document malware operators experimenting with steganography in WAV audio files — a carrier shift away from the PNG and JPG images that had been the default hiding place for embedded payloads. The move matters because audio files routinely pass through networks unexamined, giving malicious code a transport path that most scanning pipelines were not built to inspect.
The experiment proved durable rather than a one-off curiosity: later coverage shows the same logic applied elsewhere, with Symantec detailing a campaign by the Witchetty group that hid malware in a Windows logo image, and researchers documenting a previously unseen technique that stored malware inside Windows event logs. Alongside the push toward 'exotic' programming languages like Golang to hamper analysis, this marks a broader turn toward abusing trusted file formats and tooling as cover.
First-order effects
- Defenders and antivirus vendors now face a widened inspection surface: WAV files, previously treated as inert media, become a category that endpoint and gateway scanners must decode and check for embedded code.
Second-order effects
- As image-based steganography gets better detected, operators migrate to less-scrutinized carriers — the pattern that later surfaced with malware hidden in Windows event logs and in the Witchetty group's use of a Windows logo image.
Third-order effects
- If carrier-hopping continues alongside evasion tactics like writing malware in Golang, signature-based scanning of file types loses ground to behavioral detection, reshaping how endpoint security products are built.
The trend: Malware tradecraft is steadily migrating into benign-looking file formats and infrastructure — images, audio, logs, chat platforms — making carrier diversity itself a primary evasion strategy.