https://blog.malwarebytes.com/threat-analysis/2019/12/new-version-of-icedid-trojan-uses-steganographic-payloads/

this article uses Ghidra to show how malware can be hidden within a PNG file and used to hijack the browser from within and add javascript to the pages one is viewing, read the browser database (with sqlite.dll) and send all your banking info back to the hacker's HQ.

it's called an "injection attack"