Malware
Malware authors target bugs, or loopholes, to exploit. A common method is exploitation of a buffer overrun vulnerability, where software designed to store data in a specified region of memory does not prevent more data than the buffer can accommodate being supplied. Malware may provide data that overflows the buffer, with malicious executable code or data after the end; when this payload is accessed it does what the attacker, not the legitimate software, determines.
Stegomalware
The term of `stegomalware' was introduced by researchers in the context of mobile malware and presented at Inscrypt conference in 2014. However, the fact that (mobile) malware could potentially utilize steganography was already presented in earlier works: the use of steganography in malware was first applied to botnets communicating over probabilistically unobservable channels, mobile malware based on covert channels was proposed in the same year. Steganography was later applied to other components of malware engineering such as return-oriented programming and compile-time obfuscation, among others.