natural-language-payload-encoding
Pattern definition
The use of human-readable prose, poetry, or dialogue as a carrier for machine-executable payloads. Instead of encoding binary data as base64, hex, or URL-safe strings, the malware author maps byte values to words in a natural-language vocabulary and writes the payload as what appears to be ordinary text. Static analysis tools that look for high-entropy strings, MZ headers, or encoding signatures will see low-entropy English text and may pass over the carrier.
Variants
- 256-word lookup table — A fixed vocabulary of exactly 256 words (one per byte value), often arranged as a short poem or story. Observed in letsdiskusscom via the poem-word-list-steganography technique. ^[/intel/analyses/d0ca14b3ad12100898d69afacfecfbdb186fe1bd801f69aecf355413bf6e502b.html]
- BIP39 wordlist abuse — Using the standard 2048-word Bitcoin mnemonic wordlist to encode data; some infostealers already reference BIP39 wordlists for wallet scanning, making this vocabulary native to the tooling.
- Dialogue/script encoding — Embedding payloads inside fake chat logs, email transcripts, or screenplay dialogue where each line or word maps to a byte or nibble.
Cross-references
- poem-word-list-steganography — specific 256-word poem technique
- javascript-obfuscator — commercial JS obfuscation that may layer on top of prose encoding
- letsdiskusscom — family observed using this concept