---
title: Malvertising Campaign Used Steganography to Distribute Shlayer Trojan
description: VeryMal had created a Canvas object, which enabled the HTML5 Canvas API to interact with images and their underlying data
---

[News - Confiant ](https://www.confiant.com/news)

# [Malvertising Campaign Used Steganography to Distribute Shlayer Trojan](https://www.confiant.com/news/malvertising-campaign-used-steganography-to-distribute-shlayer-trojan)

 Written by [Security Boulevard](https://www.confiant.com/news/author/security-boulevard) | Jan 24, 2019 5:00:00 AM

A short-lived malvertising campaign leveraged a steganography-based payload to target Mac users with the Shlayer trojan.

Named for its use of veryield-malyst[dot]com as one of its ad-serving domains, the “VeryMal” threat actor conducted its malvertising campaign between 11 January 2019 and 13 January 2019. That’s not a long time period to remain active. But the campaign boosted its visibility by affecting two top-tier exchanges that account for approximately a quarter of the top 100 publisher sites.

Anti-malware software provider Confiant believes that this technique helped the malvertising operation generate as many as five million impressions each day it was active.

Infection began when a Mac user came across an ad containing the image of a small white bar.

This file might look unremarkable. But that wasn’t the case below the surface. That’s because VeryMal had created a Canvas object, which enabled the HTML5 Canvas API to interact with images and their underlying data.

**Read Complete Article:** [https://securityboulevard.com/2019/01/malvertising-campaign-used-steganography-to-distribute-shlayer-trojan/](https://securityboulevard.com/2019/01/malvertising-campaign-used-steganography-to-distribute-shlayer-trojan/)

[View full post](https://www.confiant.com/news/malvertising-campaign-used-steganography-to-distribute-shlayer-trojan)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Security Boulevard"
  },
  "dateModified" : "2023-01-11T04:31:35.324Z",
  "datePublished" : "2019-01-24T05:00:00Z",
  "headline" : "Malvertising Campaign Used Steganography to Distribute Shlayer Trojan",
  "image" : {
    "@type" : "ImageObject",
    "height" : 486,
    "url" : "https://f.hubspotusercontent20.net/hubfs/5994026/Imported_Blog_Media/Confiant%20Logo-2-Nov-04-2021-10-10-59-58-PM.png",
    "width" : 508
  },
  "mainEntityOfPage" : "https://www.confiant.com/news/malvertising-campaign-used-steganography-to-distribute-shlayer-trojan",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "News"
  }
}
```