That PNG Is Also a ZIP and Your Gateway Only Checked the Magic Bytes
file says PNG. unzip extracts stage.sh. same bytes, two parsers, one content filter that trusted the greeting.
PNG
Read Full News
Hide a C2 Beacon Config in a PNG Pixel and Call It a Profile Pic
the implant downloaded a profile pic, flipped the LSBs, and recovered where to phone home. no PE. just pixels. here is the lab and the hunt.