Hiding in Plain Sight: How Defenders Get Creative with Image Detection

Send us fan mail!

Hello to all our Cyber Pals! Join host Selena Larson and guest host, Sarah Sabotka, as they speak with Kyle Eaton, Senior Security Research Engineer at Proofpoint.

They explore the evolving world of image-based threat detection and the deceptive tactics cybercriminals use to evade defenses. From image lures embedded in emails, PDFs, and Office documents to the surprising ways attackers reuse visuals across campaigns, this conversation break down how detection engineering is adapting to counter new threats.

There is also examination of how AI is shaping both cyber deception and detection, raising the question of how generative AI is influencing image-based security.

Listeners will gain insights into real-world detection successes, persistent threats like TA505 and Emotet, and the role of instincts in cybersecurity—because, as Selena notes, sometimes good detection is all about the vibes. 

Key Topics Covered:

• Characteristics of Image-Based Threats
• Groups like TA505 and Emotet historically using recognizable image lures
• OneNote-Based Malware Detection (2023) & the Challenges with OneNote
• Shift to PDF-Based Threats
• PDF Object Hashing for Attribution & Detection
• Image-Based Threat Detection Insights
• Generative AI’s Impact on Image-Based Threats

Join us as we uncover real-world detection wins, explore persistent threats like TA505 and Emotet, and dive into the importance of instincts in cybersecurity—because, as our guest puts it, sometimes good detection is all about the vibes.

Resources mentioned:

https://github.com/target/halogen

https://www.proofpoint.com/us/blog/threat-insight/onenote-documents-increasingly-used-to-deliver-malware

For more information about Proofpoint, check out our website.

Subscribe & Follow:

Don't miss out on future episodes—subscribe to the Discarded Podcast on your favorite platform.