Exif Smuggling
Summary
Exif Smuggling is a proof-of-concept attack that hides an executable payload inside a JPG's Exif data, enabling passive download via browser image caching without additional network requests.
View Cached Full Text
Cached at: 06/10/26, 12:22 AM
signalblur/exifsmugglingpoc
Source: https://github.com/signalblur/exifsmugglingpoc
Exif Smuggling
A Proof-of-Concept evolution of Cache Smuggling. This attack conceals an executable payload inside a JPG’s Exif data. As a result, image caching (such as that of a Web Browser) can be used to passively download the payload.
As a result, the example loader (chrome_poc.ps1) does not need to make any internet requests to fetch the second stage payload.
Instead, it simply extracts it from the Chrome browser’s cache.
For full details see: https://malwaretech.com/2025/10/exif-smuggling
Example Usage
Convert PowerShell Loader to ClickFix Command
python3 build_clickfix_cmd.py --input-file chrome_poc.ps1 --output-file encoded_command.txt --fake-path "C:\test\doc.txt"
Embed payload dll inside arbitrary JPG
python3 exif_smuggling.py --input-file image.jpg --output-file payload.jpg --payload hello_world.dll
Example Phishing page
www/index.html
Similar Articles
Inside Ghostcommit: How Malicious PNGs Bypass AI Code Reviewers
Ghostcommit is a novel supply chain exploit that uses malicious PNG images containing text instructions to bypass AI code reviewers, leading to data exfiltration from developer environments.
'Ghostcommit' hides prompt injection in images to fool AI agents, steal secrets
Researchers demonstrate a new prompt injection attack where malicious instructions hidden in images bypass AI code reviewers and cause coding agents to leak repository secrets.
Microsoft Copilot Cowork Exfiltrates Files
A security vulnerability in Microsoft Copilot Cowork allows attackers to exfiltrate files by exploiting prompt injection that triggers external image requests, potentially leaking pre-authenticated download links.
Config Files That Run Code: Supply Chain Security Blindspot
Config files for IDEs, AI coding agents, and package managers can execute code automatically, creating a supply chain security blindspot. The article details the Miasma worm attack that uses such config files to drop malware, and provides examples of injection vectors.
The AI Workspace Hijack: Anatomy of the Jscrambler NPM Attack
Attackers hijacked Jscrambler's NPM credentials to release malicious versions that steal API keys and developer history from AI tools like Cursor and Claude Desktop using an undocumented Rust-based infostealer.