Researchers at Positive Technologies have identified over 320 attacks in a malware campaign primarily targeting organizations in Latin America leveraging steganography to obfuscate malicious payloads. The hacking group TA558 is believed to be behind the operation. The SteganoAmor attack begins with a phishing email that is sent from compromised SMTP servers to exploit the positive reputation of existing domains. The phishing email contains Microsoft documents such as Excel or Word that are crafted to exploit a known Microsoft Equation Editor vulnerability tracked as CVE-2017-11882. This flaw is nearly seven (7) years old, and the exploit will check the version of Microsoft Office installed to determine whether it will advance to the next stage of the campaign which downloads a Visual Basic Script (VBS). The script grabs an image file which uses steganography to hide PowerShell code that downloads the final payload stored in a legitimate cloud service to evade detection by anti-virus tools. Researchers have seen multiple forms of malware delivered via the final payload including AgentTesla, Remcos, LokiBot, XWorm, and more. All are forms of either remote access tools or infostealers, designed to send stolen information back to the attacker on compromised FTP servers. The use of steganography in this attack provides an evasion technique not commonly seen in modern campaigns. However, the flaw in Equation Editor required to carry out the attack is quite old, meaning organizations with later versions of Microsoft Office are safe from the SteganoAmor campaign. CTIX analysts will continue to report on novel and evolving malware versions and associated campaigns.