Spam emails with embedded links don't use steganography, but they use a similar redirect attack. I have reverse engineered many of them, and, for a lot of them, I am struck by the sense of whimsy in the choice of variable names the attackers use. Clearly, they are having fun doing these scripts. It always struck me as sad that these possibly talented (and apparently pretty happy) developers have been steered into crime instead of a probably lucrative honest career in software.