Favicon Trojans: Executable Steganography Via Ico Alpha Channel
  Exploitation
This paper presents a novel method of executable steganography using the
alpha transparency layer of ICO image files to embed and deliver
self-decompressing JavaScript payloads within web browsers. By targeting the
least significant bit (LSB) of non-transparent alpha layer image values, the
proposed method successfully conceals compressed JavaScript code inside a
favicon image without affecting visual fidelity. Global web traffic loads 294
billion favicons daily and consume 0.9 petabytes of network bandwidth. A
proof-of-concept implementation demonstrates that a 64x64 ICO image can embed
up to 512 bytes uncompressed, or 0.8 kilobyte when using lightweight two-fold
compression. On page load, a browser fetches the favicon as part of standard
behavior, allowing an embedded loader script to extract and execute the payload
entirely in memory using native JavaScript APIs and canvas pixel access. This
creates a two-stage covert channel requiring no additional network or user
requests. Testing across multiple browsers in both desktop and mobile
environments confirms successful and silent execution of the embedded script.
We evaluate the threat model, relate it to polymorphic phishing attacks that
evade favicon-based detection, and analyze evasion of content security policies
and antivirus scanners. We map nine example MITRE ATT&CK Framework objectives
to single line JavaScript to execute arbitrarily in ICO files. Existing
steganalysis and sanitization defenses are discussed, highlighting limitations
in detecting or neutralizing alpha-channel exploits. The results demonstrate a
stealthy and reusable attack surface that blurs traditional boundaries between
static images and executable content. Because modern browsers report silent
errors when developers specifically fail to load ICO files, this attack surface
offers an interesting example of required web behaviors that in turn compromise
security.
68762de6257d4f04353706a2
David Noever
68762de6257d4f04353706a3
Forrest McKee
Favicon Trojans: Executable Steganography Via Ico Alpha Channel
  Exploitation
This paper presents a novel method of executable steganography using the
alpha transparency layer of ICO image files to embed and deliver
self-decompressing JavaScript payloads within web browsers. By targeting the
least significant bit (LSB) of non-transparent alpha layer image values, the
proposed method successfully conceals compressed JavaScript code inside a
favicon image without affecting visual fidelity. Global web traffic loads 294
billion favicons daily and consume 0.9 petabytes of network bandwidth. A
proof-of-concept implementation demonstrates that a 64x64 ICO image can embed
up to 512 bytes uncompressed, or 0.8 kilobyte when using lightweight two-fold
compression. On page load, a browser fetches the favicon as part of standard
behavior, allowing an embedded loader script to extract and execute the payload
entirely in memory using native JavaScript APIs and canvas pixel access. This
creates a two-stage covert channel requiring no additional network or user
requests. Testing across multiple browsers in both desktop and mobile
environments confirms successful and silent execution of the embedded script.
We evaluate the threat model, relate it to polymorphic phishing attacks that
evade favicon-based detection, and analyze evasion of content security policies
and antivirus scanners. We map nine example MITRE ATT&CK Framework objectives
to single line JavaScript to execute arbitrarily in ICO files. Existing
steganalysis and sanitization defenses are discussed, highlighting limitations
in detecting or neutralizing alpha-channel exploits. The results demonstrate a
stealthy and reusable attack surface that blurs traditional boundaries between
static images and executable content. Because modern browsers report silent
errors when developers specifically fail to load ICO files, this attack surface
offers an interesting example of required web behaviors that in turn compromise
security.