Malware hides behind JavaScript, PNGs to bypass browser security

A newly discovered cross-site scripting attack uses a sly variant on an existing hack to deliver malware in a way that’s so heavily obfuscated, even experts didn’t notice it at first.

http://www.infoworld.com/t/malware/malware-hides-behind-javascript-pngs-bypass-browser-security-235594