Since a large number of Trojans are easily tracable on the Internet, a new Trojan attack scheme based on multimedia document was proposed. Firstly, the Trojan program was embedded into a carrier image as secret data by steganography. After the Trojan program was successfully injected, the encrypted user information was also hidden into the carrier image by steganography. Then the host automatically uploaded pictures to a social network. Finally, the attacker downloaded images from the social network and extracted secret data from images. The theoretical analysis and simulation results show that the proposed JPEG image steganography algorithm has good performance, and the Trojan scheme based on it outperfoms some existing algorithms in concealment, anti-forensics, anti-tracking and penetrating auditing. Such Trojans in social networks can cause user privacy leaks, so some precautions are given at last.