The authors turned to polyglot images to add the JavaScript code that redirects to a page offering a fake reward. The malicious code is hidden in a BMP type of picture and it is heavily obfuscated.

Here’s an interesting proof-of-concept that could be useful or hazardous depending on the situation in which you encounter it. [jklmnn] drew inspiration from the work of [Ange Albertini] who … ...

Computer science graduate students Zifeng Kang and Song Li contributed to the research. The team members will present their paper "Probe the Proto: Measuring Client-Side Prototype Pollution ...