Invisible by Default: The Polyglot Smuggler

Modern defense-in-depth architectures rely heavily on validating primary media streams, often implicitly trusting ancillary accessibility sub-channels to preserve business continuity. As commercial devices increasingly embed rich telemetry into video metadata tracks, perimeter sanitization engines are forced to pass this data intact, creating a severe operational blind spot.

While traditional data concealment methods, such as Least Significant Bit (LSB) steganography, are readily detected by Endpoint Detection and Response (EDR) solutions because they rely on third-party extraction tools, modern tradecraft requires zero-footprint alternatives.

This paper demonstrates a novel data smuggling mechanism: Sub-Channel Steganography. By weaponizing uninspected MP4 subtitle tracks within a structurally compliant ISO base media file, adversaries can encapsulate malicious payloads and exfiltrate sensitive data. Utilizing entirely native "Living off the Land" (LotL) interpreters for bidirectional extraction, this polyglot methodology successfully circumvents network Data Loss Prevention (DLP) and Content Disarm and Reconstruction (CDR) systems while eliminating the forensic artifacts traditionally monitored by endpoint defenses.