An unusual attack using an open-source package installer called Chocolatey, steganography and Scheduled Tasks is stealthily delivering spyware to companies.

The malware has been found in the French construction and government sectors and uses steganography, Tor proxy and package installer software, Proofpoint says.