computer-science
Exif Smuggling
Key takeaways
- This attack conceals an executable payload inside a JPG's Exif data.
- As a result, the example loader (chrome_poc.ps1) does not need to make any internet requests to fetch the second stage payload.
- For full details see: https://malwaretech.com/2025/10/exif-smuggling
A Proof-of-Concept evolution of Cache Smuggling. This attack conceals an executable payload inside a JPG's Exif data. As a result, image caching (such as that of a Web Browser) can be used to passively download the payload.
As a result, the example loader (chrome_poc.ps1) does not need to make any internet requests to fetch the second stage payload. Instead, it simply extracts it from the Chrome browser's cache.
For full details see: https://malwaretech.com/2025/10/exif-smuggling
Article preview — originally published by Hacker News. Full story at the source.
Read full story on Hacker News →
More top stories
Aggregated and edited by the Scoop newsroom. We surface news from Hacker News alongside other reporting so you can compare coverage in one place.
Editorial policy · Corrections · About Scoop