标题： Favicon 恶意软件：通过 Ico 透明通道利用的可执行隐写术 显示英文标题

标题： Favicon Trojans: Executable Steganography Via Ico Alpha Channel Exploitation

摘要： 本文提出了一种使用ICO图像文件的alpha透明度层进行可执行隐写术的新方法，以在网页浏览器中嵌入和传递自解压JavaScript有效负载。 通过针对非透明alpha层图像值的最低有效位（LSB），所提出的方法成功地将压缩的JavaScript代码隐藏在favicon图像中，而不会影响视觉保真度。 全球网络流量每天加载2940亿个favicon，并消耗0.9拍字节的网络带宽。 一个概念验证实现表明，64x64 ICO图像可以嵌入最多512字节的未压缩数据，或使用轻量级两倍压缩时为0.8千字节。 在页面加载时，浏览器会按照标准行为获取favicon，使得嵌入的加载器脚本能够使用原生JavaScript API和画布像素访问功能在内存中完全提取和执行有效负载。 这创建了一个两阶段的隐蔽通道，无需额外的网络或用户请求。 在桌面和移动环境中的多个浏览器上进行的测试证实了嵌入脚本的成功且无声执行。 我们评估了威胁模型，将其与逃避基于favicon检测的多态性钓鱼攻击相关联，并分析了内容安全策略和杀毒扫描程序的规避情况。 我们将九个MITRE ATT&CK框架目标映射到单行JavaScript，以在ICO文件中任意执行。 讨论了现有的隐写分析和清理防御措施，突出了在检测或中和alpha通道漏洞方面的局限性。 结果表明，这种隐蔽且可重复利用的攻击面模糊了静态图像和可执行内容之间的传统边界。 由于现代浏览器在开发人员特定未能加载ICO文件时报告静默错误，此攻击面提供了一个有趣的示例，说明了必要的网络行为反过来损害安全性的情况。 显示英文摘要

摘要： This paper presents a novel method of executable steganography using the alpha transparency layer of ICO image files to embed and deliver self-decompressing JavaScript payloads within web browsers. By targeting the least significant bit (LSB) of non-transparent alpha layer image values, the proposed method successfully conceals compressed JavaScript code inside a favicon image without affecting visual fidelity. Global web traffic loads 294 billion favicons daily and consume 0.9 petabytes of network bandwidth. A proof-of-concept implementation demonstrates that a 64x64 ICO image can embed up to 512 bytes uncompressed, or 0.8 kilobyte when using lightweight two-fold compression. On page load, a browser fetches the favicon as part of standard behavior, allowing an embedded loader script to extract and execute the payload entirely in memory using native JavaScript APIs and canvas pixel access. This creates a two-stage covert channel requiring no additional network or user requests. Testing across multiple browsers in both desktop and mobile environments confirms successful and silent execution of the embedded script. We evaluate the threat model, relate it to polymorphic phishing attacks that evade favicon-based detection, and analyze evasion of content security policies and antivirus scanners. We map nine example MITRE ATT&CK Framework objectives to single line JavaScript to execute arbitrarily in ICO files. Existing steganalysis and sanitization defenses are discussed, highlighting limitations in detecting or neutralizing alpha-channel exploits. The results demonstrate a stealthy and reusable attack surface that blurs traditional boundaries between static images and executable content. Because modern browsers report silent errors when developers specifically fail to load ICO files, this attack surface offers an interesting example of required web behaviors that in turn compromise security.