TL;DR
Hiding data inside a PNG is called steganography. People do it for fun, for privacy, and for research, but attackers do it too. They tuck secret files, malware, and stolen data inside images that look completely normal. This guide walks through the real methods used to hide data in a PNG, shows why PNG is the favorite carrier, and explains how security teams spot the hidden payload before it does damage.
Introduction
In 2024, researchers watched a group called Worok slip malware into PNG images one pixel at a time. The pictures opened fine in any viewer. Nobody looking at them would guess that hidden inside the color values sat a working piece of spyware.
That trick is called steganography, and it is one of the oldest ways to keep a secret in plain sight. This guide breaks down how it works, what tools do the job, and where the line sits between a fun experiment and a real threat.
The Main Ways to Hide Data in a PNG
There is no single method. Each one trades off how much you can hide, how easy it is to spot, and how much skill it takes. Here are the ones people actually use.
Where Data Actually Hides Inside a PNG File
A PNG is not one solid block. It is a stack of labeled chunks, and four of them can carry a passenger.
The 8 bytes that say “I am a PNG”
Fixed header every viewer checks first. Nothing hides here.
Width, height, color depth
Tells you the color depth. A PNG with only 2, 4, or 16 colors is odd enough to check twice.
The color palette
Low color images leave spare bits at the end of each pixel row. Those leftovers can hold data.
The compressed pixels
The main event. LSB editing swaps the last bit of each color value. Unzip the chunk, edit the pixel rows, zip it back. Any file type fits.
Notes and captions
Plain text fields meant for credits. Quick to stuff, and the first place an analyst looks.
End of image marker
Most viewers stop reading here and render the picture.
Nothing should be here
The viewer ignores it. The file still carries it. A whole executable can sit behind a valid image, and a normal PNG never has this.
Reading this as a defender: two of these are free wins. Data after IEND and an unusual color depth both show up in a file scan without any statistical math. The IDAT and metadata hide spots need real steganalysis.
Least Significant Bit (LSB) Editing
This is the classic method and the easiest to learn. Every pixel is made of color numbers. The last bit of each number barely changes the color, so you swap those last bits for the bits of your secret message. The picture looks identical to the human eye. Worok used exactly this approach to embed malware chunks across an image. LSB is simple, but it is also the easiest for a scanner to catch.
Hiding Data in the IDAT Pixel Block
A PNG is built from chunks. The IDAT chunk holds the compressed pixel data. You unzip it, edit some bytes in the pixel rows, then zip it back up. This is a structural cousin of LSB and lets you hide any file type, not just text. It takes more effort but gives you more room.
Appending Data After the IEND Marker
This is the laziest trick and it works shockingly well. Most image viewers stop reading at the IEND marker, which signals the end of the picture. Anything you paste after that marker gets ignored by the viewer but still sits inside the file. Attackers love this because you can hide a whole executable behind a valid image.
Stuffing Text Into Metadata Chunks
PNG supports text chunks called tEXt, zTXt, and iTXt for storing notes and captions. You can drop plain text straight into these fields. It is quick, but it is also the first place a curious analyst will look.
Palette and Bit-Padding Tricks
Low-color PNGs sometimes leave unused bits at the end of each pixel row. Those spare bits can hold data. This method is rare and honestly a red flag on its own. A PNG with only 2, 4, or 16 colors is unusual enough to make an analyst suspicious right away.
Four Methods, Four Different Trade Offs
More capacity usually means more noise. Filled bars mean more of that thing.
LSB Editing
Swap the last bit of each color value. Invisible to the eye. The method Worok used to move malware into images.
IDAT Block Editing
Unzip the pixel chunk, edit the rows, zip it back. Holds any file type, not just text. More work, more room.
Appending After IEND
Paste a payload past the end marker. The viewer ignores it. The laziest trick on the list and it works.
Metadata and Palette
Drop text into tEXt fields, or use spare bits in low color rows. Fast, small, and loud once anyone checks.
The pattern that matters: the two easiest methods are also the two easiest to detect. Attackers still use them, because most pipelines never open the image at all.
The Tools People Use
You do not need to be a coder to try this. A mix of free tools and open-source projects handle the work.
Common options include:
- StegHide and OpenStego for embedding files into images with a password.
zsteg and StegSolve for pulling hidden data back out and for analysis. - Binwalk for spotting files buried inside other files.
- Online LSB tools that add AES encryption before hiding the message, so the extracted data is useless without the key.
- Open-source code like the steganography-png project on GitHub, which hides any file type inside a PNG from the command line.
Why Attackers Love This Trick
Here is where the fun experiment turns serious. Steganography is a favorite of real threat actors because security tools often trust images and skip over them.
The numbers back this up. Cofense Intelligence reports that Remcos RAT is the most common malware delivered through steganography campaigns, making up 27% of the volume. Those campaigns first peaked in 2024 and stayed steady through 2025. Most of them hide a loader inside an image file that is built to be hard to detect and hard to stop.
The examples keep coming. The LummaC2 and Vidar infostealers used LSB steganography inside their PNG output to run the final payload on a victim machine. RAT families like AsyncRAT forks and XWorm hide stolen data inside PNG screenshots and upload them to Discord, which acts as free bandwidth because images are rarely scanned deeply. State-sponsored groups use image-based channels to sneak commands past network monitors that see only a harmless image download.
Data theft is the flip side. Picture an employee downloading what looks like a big folder of vacation photos. In reality, gigabytes of company secrets are hidden inside those images, walking straight out the door.
How Security Teams Catch Hidden Data
The Signals Worth Watching For
Hiding data is clever. It is not invisible. These are the tells, grouped by how much work each one takes.
Free wins, no analysis required
Data sitting after the IEND marker
A clean PNG never has bytes past the end marker. Anything there was put there on purpose.
File size out of line with the image
A small screenshot that weighs several megabytes is carrying something.
Unusual color depth
A PNG limited to 2, 4, or 16 colors points at palette and bit padding tricks.
Odd metadata
Strange modification dates or properties that do not match the stated source tool.
Needs real steganalysis
Chi Square and similar statistical tests
LSB editing leaves patterns in the bit distribution that normal photos do not have.
Bit plane inspection
Tools like zsteg and StegSolve pull apart the layers so a buried message becomes readable.
Embedded file scanning
Binwalk and similar tools find file signatures buried inside other files.
Needs context, not just a scan
Where the image is going
Screenshots uploading to Discord or a chat service is a known exfiltration path for RAT families.
Volume that does not fit the user
A folder of vacation photos leaving a finance account at 2am is a story, not a file property.
The scale problem: a busy company moves thousands of images a day. Signals 1 through 4 are cheap to automate. Signals 8 and 9 need the image tied to user behavior, network context, and a known attack pattern. That is where a one off scan stops being enough.
The hiding is clever, but it is not invisible. Steganalysis is the practice of finding hidden data, and defenders have real signals to work with.
Warning signs and detection methods include:
- File size that is much larger than a normal image of the same type.
- Statistical tests like the Chi-Square test that spot the odd patterns LSB editing leaves behind.
- Palette checks that flag unusual color depth.
- Data sitting after the IEND marker, which a normal image never has.
- Odd metadata, like strange modification dates or inconsistent properties.
The hard part is scale. A busy company sees thousands of images move across its network every day. Checking each one by hand is impossible. That is why detection has to be automated and tied into the wider security picture, not run as a one-off scan.
