Malware

Invoke-PSImage

Invoke-PSImage is a PowerShell-based steganographic tool used to embed payload data, specifically PowerShell scripts, within image files, including PNG images and newly created image files. The provided content describes it as a tool that encodes PowerShell script content into the pixels of a PNG/image file to conceal the payload. This behavior aligns it with image-based payload hiding and embedded-payload tradecraft used to evade detection and stage follow-on execution. The content does not provide a specific threat actor exclusively associated with Invoke-PSImage, but it places the tool in the broader context of malware and intrusion activity that uses steganography and embedded payloads in images. No specific infection vector, targeted industry, or indicators of compromise are directly provided beyond its use of PNG/image files as the carrier for embedded PowerShell payloads.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

3 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1588.002ToolEvidence2

The content repeatedly states that threat actors 'obtained,' 'acquired,' or 'used' publicly available, open-source, legitimate, or modified tools such as Mimikatz, Cobalt Strike, PsExec, Empire, Impacket, and many others.

Execution

1 technique

T1059.001PowerShellEvidence2

The content includes use of PowerSploit, Empire, Invoke-PSImage, and PowerShell-centric post-exploitation frameworks by multiple actors.

Command and Control

1 technique

T1573Encrypted ChannelEvidence1

Sandworm Team used Invoke-PSImage “to establish an encrypted channel from a compromised host to [their] C2 server.”

ACTIVITY FEED

Recent activity

5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

5 SOURCESView more in app

mitre attack websiteNews

May 1, 2020

Obfuscated Files or Information: Embedded Payloads, Sub-technique T1027.009 - Enterprise | MITRE ATT&CK®

Can embed payload data within a new image file.

mitre attackNews

Jan 24, 2026

Obfuscated Files or Information: Embedded Payloads, Sub-technique T1027.009 - Enterprise | MITRE ATT&CK®

PowerShell-based tool used to embed payload data into image files (steganography) for delivery/execution workflows.

mitre attackNews

Jan 24, 2026

Obfuscated Files or Information: Steganography, Sub-technique T1027.003 - Enterprise | MITRE ATT&CK®

PowerShell-based steganography tool used to embed PowerShell scripts into PNG pixel data for covert delivery/execution.

mitre attackNews

Jan 25, 2026

Obfuscated Files or Information: Embedded Payloads, Sub-technique T1027.009 - Enterprise | MITRE ATT&CK®

PowerShell tool used to embed payload data within image files.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping3

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Invoke-PSImage