Proofpoint researchers Bryan Campbell, Zachary Abzug, Andrew Northern and Selena Larson say that this is the first time they have observed a threat actor use Chocolatey in campaigns, and that steganography is, in general, rarely used by attackers.