Steganography

A subject embeds data within an audio file or audio stream so that the concealed information is carried inside apparently legitimate sound content. The audio may continue to play normally, while modifications to the underlying samples, frequency components, timing, phase, or file structure contain a hidden payload.

Audio steganography may be used to conceal sensitive organizational data within music, voice recordings, podcasts, meeting recordings, sound effects, or other audio content before the file is transferred through an approved or commonly used communication channel. The subject may select audio because normal variations in sound, background noise, and compression can make small alterations difficult to identify through ordinary review.

Methods may include modifying the least significant bits of audio samples, altering phase or frequency characteristics, inserting information into low-audibility ranges, using echo-based encoding, or appending data within fields not required for normal playback. The concealed payload may also be encrypted before embedding, preventing recovery of its contents even where investigators identify that steganography has been used.

A subject conceals data within a business document by using content, objects, fields, formatting, or internal structures that are not visible during ordinary viewing.

The carrier may be a word-processing document, spreadsheet, presentation, Portable Document Format file, or another document type routinely used by the organization. The document may open and display expected content while containing hidden text, files, archives, scripts, worksheets, comments, embedded objects, metadata, or other concealed material.

Methods may include white text on a white background, extremely small font sizes, content positioned outside the visible page, hidden spreadsheet rows or worksheets, concealed presentation objects, embedded files, unused form fields, custom metadata, document layers, or internal package relationships.

A subject conceals data within unused, ignored, optional, or non-rendered areas of a file or container so that the carrier continues to function normally while the hidden payload remains outside the content presented to the viewer.

The technique may use padding, reserved fields, unused headers, slack areas, archive comments, trailing data, application-specific metadata, or other structures retained during transfer but not normally displayed or processed. Examples include placing data after the logical end of a file, storing content in unused container fields, or exploiting differences between how applications and security tools interpret the same format.

This behavior may frustrate investigation because the visible content appears benign and the concealed data may only be identified through structural parsing, hexadecimal examination, file carving, or validation against the relevant file-format specification.

A subject embeds data within image files to hide sensitive content and exfiltrate it, in a way that conceals both the data and the act of exfiltration. Unlike encryption alone, this attempts to hide the existence of the data.

Trade-offs

• LSB and EOF: High capacity, low complexity, fragile to inspection
• Transform and Edge-based: Higher stealth, lower capacity, more resilient
• Appended EOF: Minimal technical skill required, common in low-effort exfiltration attempts

A subject conceals information within apparently ordinary written text by manipulating characters, spacing, formatting, language patterns, or other textual features that are unlikely to attract attention during normal reading.

The visible content may appear to be a legitimate email, document, chat message, report, source-code comment, or other written communication. Hidden information may be encoded through additional spaces or tabs, capitalization, punctuation, selected words, spelling variations, character placement, font changes, Unicode substitutions, zero-width characters, or bidirectional control characters.

Text steganography may be used to communicate small quantities of sensitive information, instructions, identifiers, authentication material, or encoded content without creating an obvious attachment or visible block of ciphertext.

A subject embeds data within a video file or video stream to conceal sensitive information inside apparently legitimate visual or audiovisual content.

Video files provide multiple locations for hidden data, including individual frames, color values, compression coefficients, motion data, audio tracks, subtitles, metadata, and unused container structures. A subject may distribute a payload across many frames or components, reducing the amount of alteration applied to any single part of the file.

The resulting video may appear and play normally while carrying documents, source code, credentials, records, archives, or other organizational data. The subject may transfer the video through email, cloud storage, messaging platforms, or media-sharing services where large audiovisual files are expected.