Hiding data in packet header

Do some research and provide an actual example of a header being modified and your thoughts on how it was implemented. This can be an actual malware case, breach, white paper, or another similar example. For your example, can you think of any ways that it might be prevented or detected?