Invoke-PSImage

MITRE ATT&CK: S0231 View on attack.mitre.org

Aliases: Invoke-PSImage

First seen
2017-05-01 00:00:00
Malware type
credential-stealer, trojan
Profile updated
2026-07-07 15:32:01

Targeted industries: government-and-public-sector financial-services healthcare-and-pharmaceutical

Context

Invoke-PSImage takes a PowerShell script and embeds the bytes of the script into the pixels of a PNG image. It generates a one liner for executing either from a file of from the web. Example of usage is embedding the PowerShell code from the Invoke-Mimikatz module and embed it into an image file. By calling the image file from a macro for example, the macro will download the picture and execute the PowerShell code, which in this case will dump the passwords.

Detection coverage

  • 6 Sigma rules

Malware & tools used

  • Steganography (attack-pattern)
  • Embedded Payloads (attack-pattern)

Used by threat actors

Reports & references

  • MITRE ATT&CK — S0231 (report)
  • github.com — Invoke Psimage (report)

External references