Given your comment I will skip the historical info but if you want you can read it in this paper.
The answer to your end question is yes, it's being practically used.
The following malware programs and cyberespionage tools are known to have used it:
- Enfal (Zero.T loader);
- Triton (Fibbit)
There are some advantages for its use in the cases of malware:
data (and the actual data transfer) can be better concealed
makes Anti-malware tools useless against such technique
bypasses Deep packet inspection (DPI)
can bypass Anti-Advanced Persistent Threat (AAPT) measures
steganography detection programs are today at a state of proof-of-concept having no practical reliability whatsoever
So basically, for deploying data to be used later, steganography is an excellent way to do it and in the specific case of malware and data retrieving advanced systems like KATA (Kaspersky Lab’s Anti-Targeted Attack) will only be able to help when something already bad starts to happen.
From a more peaceful perspective, I could just use images for password storage and no-one would never know and I did implement such a solution in practice. Imagine a standard password. Each character of it has a hex value. A bitmap's pixel values also have a hex value. With a very easy to construct program, you can store your password inside a bitmap by altering specific pixels with close values to your password's hex with the actual password character value. If the picture is unique (aka not from the internet so there's a comparison possibility) there is no way whatsoever to determine if a pixed has the original color code or it's something altered.