A sophisticated macOS attack achieved firmware-level persistence via NVRAM exploitation, surviving complete operating system reinstalls. Over a four-month campaign (June-October 2025), the compromise created 3,247 hidden directories, modified over 600,000 files, and exfiltrated data via APFS snapshots routed through the victim's own AWS account. CVSS 9.1 Critical. In response, we present Chameleon -- a dynamic steganographic defense framework that weaponizes steganography for active defense through three capabilities: canary injection for data-leak detection, covert channel identification, and counter-steganographic poisoning of attacker communication channels. Combined with overt defense systems such as Mantis, Chameleon delivers full-spectrum coverage against both known and unknown threat vectors.