Episode 38: Image, File, and Voice-Based Threats (Domain 2)

While emails and text messages are well-known vectors, attackers also exploit images, file attachments, and voice communication to bypass traditional security controls. In this episode, we explore steganography—embedding malicious code or data within image files—as well as the risks posed by file-based threats hidden in PDFs, Office documents, and ZIP archives that exploit unpatched applications or social engineering weaknesses. We also examine voice-based phishing, or vishing, where attackers impersonate trusted parties over the phone to trick targets into revealing sensitive information, transferring funds, or installing remote access tools. These methods often escape automated detection because they rely on human interaction or use file formats that appear harmless. Defending against them requires a combination of endpoint protection, application whitelisting, call-back verification policies, and strong user education. As attackers diversify their methods, defenders must account for all input channels—not just the obvious ones.