What Is a Format Boundary Attack?

Every security tool has a parser. Your email gateway parses MIME. Your sandbox detonates executables. Your EDR watches process behaviour. Each parser is competent within its domain. The problem is the handoff. When a phishing email contains a Word document that embeds a PNG image that hides a PowerShell script, the payload crosses four format boundaries. Most security architectures treat each boundary as someone else's problem. Attackers have learned to exploit that assumption with devastating efficiency.

The Parser Handoff Problem

Modern security infrastructure is built around format specialisation. Email security gateways excel at MIME parsing, header analysis, and attachment extraction. Sandbox environments detonate executables and observe runtime behaviour. Static analysis engines parse scripts for known-malicious patterns. Each tool operates within a defined format scope.

This specialisation creates what Elastic Security Labs documented in their 2024 GHOSTPULSE analysis: a structural gap at every format transition. When GHOSTPULSE embeds encrypted payload data within PNG IDAT chunks, the email gateway sees a clean attachment, the image scanner sees a valid PNG, and the script analyser never receives anything to scan. The malicious content exists between parsers, visible to none of them individually.

Taxonomy of Format Boundaries

Not all format boundaries carry equal risk. The table below maps the most commonly exploited transitions in real-world campaigns, ordered by prevalence in 2025-2026 threat telemetry.

The Inverse Depth-Sophistication Relationship

One pattern that emerges from analysing multi-format campaigns is this: the more format boundaries a chain crosses, the simpler each individual layer tends to be.

XWorm's 2025 campaigns cross four format boundaries (email, Office document, steganographic image, PowerShell script) but use only Base64 encoding and single-byte XOR at each transition. AgentTesla variants follow the same pattern. The sophistication budget is spent on the chain architecture, not on per-layer encoding strength.

This makes sense from an operational perspective. Each format boundary adds complexity to the delivery infrastructure. Adding a steganographic embedding step requires image generation tooling, payload alignment, and quality assurance that the carrier image renders correctly. Investing further in advanced obfuscation at each layer produces diminishing returns when the format transition alone defeats most scanners.

Eight Campaigns That Exploit Format Boundaries

The following campaigns represent the current state of multi-format delivery. Each exploits at least two format boundaries, with the most advanced chains crossing four or five.

The trend is clear. XWorm detections surged throughout 2025, with ANY.RUN's malware trends data ranking it among the most prevalent threats globally. Nearly all observed variants used multi-format delivery chains rather than single-format obfuscation. The delivery infrastructure is evolving faster than per-sample encoding techniques.

Why Sandbox Detonation Misses Format Boundaries

Dynamic analysis environments execute the final payload and monitor system behaviour. This is excellent for identifying what malware does once active. It is fundamentally limited for understanding how it arrived.

Format boundary transitions happen in the loader code, not in the final payload. When TA558's SteganoAmor chain extracts Base64 data from a JPG image and reconstructs it into a payload, that reconstruction logic runs in a script context that may not trigger sandbox detonation at all. The sandbox sees either a clean Office document (if macro execution is blocked) or the final payload (if execution succeeds), but never the format boundary crossing itself.

Static Analysis at the Boundary

The Industrialisation of Format Chains

Format boundary attacks are no longer bespoke operations. Positive Technologies' 2024 analysis of TA558's SteganoAmor campaign documents a group that delivers multiple malware families (AgentTesla, FormBook, Remcos, XWorm) through a consistent email-to-Office-to-image-to-script infrastructure, suggesting modular delivery tooling. Unit 42's analysis of PhantomVAI reveals a similar pattern: a Malware-as-a-Service platform where the multi-format delivery chain is the product being sold.

This industrialisation means format boundary attacks are no longer limited to advanced threat actors. Commodity RAT operators can purchase delivery infrastructure that crosses three or four format boundaries without understanding the underlying techniques. The barrier to entry has collapsed while the detection challenge remains.

Implications for Detection Engineering

Traditional detection rules operate within a single format domain. A YARA rule matches byte patterns in a file. A Sigma rule correlates log events. Neither is designed to span format boundaries.

Detecting format boundary attacks requires container-aware correlation: the ability to track content identity across format transitions. When a Base64 string extracted from a PNG steganographic payload matches a known C2 URL pattern, the detection must trace that match back through the image, the Office document, and the email to produce actionable context. MITRE ATT&CK captures part of this under T1027.009 (Embedded Payloads) and T1566.001 (Spearphishing Attachment), but the framework does not yet model the transitions themselves as distinct detection opportunities.