Steganography has been utilized by IDAT Loader, which has similarities with the Hijack Loader, for Remcos RAT distribution, with the remote access trojan previously spread by the TA544 threat operation using the same malware loader.
Article Link: Remcos RAT deployed via IDAT Loader | SC Media