Unless the code hidden there is magically executed, this is just a way of hiding data, and not exactly a malware attack vector. To make this work, you need to

Unless the code hidden there is magically executed, this is just a way of hiding data, and not exactly a malware attack vector. To make this work, you need to already run on the host the code that extracts the hidden malware and executes it, and at that point you have something that is detectable.