Your question doesn't make any fucking sense in the context of attacking anything, steganography is encoding your message inside redundant encoding for something else.

So, about that word.

A "virus in an image" situation is for cases when a program which will open that image has some vulnerability the attacker knows about, so the image is formed specifically to execute some shellcode in this situation.

Same with "a virus in an MP3", some MP3 decoder has a known vulnerability allowing a shellcode.

Same with PDFs and anything else.

There are more high-level situations where programs with their own complex formats (say, DOCX which is a ZIP archive with some crap inside) execute stuff.

All this is not steganography.

Steganography is when, a dumb example, you have an image and you hide your message in lower bits of pixel color values. Or something like that with an MP3 file.

Obviously I’m not hiding an executable in there, but I don’t see why you couldn’t try for unsanitized input, you never know.

Attacks are a matter of probabilities, and "you never know" doesn't suffice.