In 2018 people discovered that Twitter would recompress images but leave the embedded ICC profile, if present, intact, and used that to make a Twitter-surviving

In 2018 people discovered that Twitter would recompress images but leave the embedded ICC profile, if present, intact, and used that to make a Twitter-surviving JPEG+ZIP polyglot[1], although that got patched out once someone used it as a C&C channel[2]. Apparently that still worked (and was utilized for the same purpose) on Steam user profiles in 2021[3]. [1] https://twitter.com/David3141593/status/1057042085029822464 https://twitter.com/David3141593/status/1057042085029822464 [2] https://www.trendmicro.com/en_us/research/18/l/cybercriminals-use-malicious-memes-that-communicate-with-malware.html https://www.trendmicro.com/en_us/research/18/l/cybercriminal... [3] https://twitter.com/miltinh0c/status/1392944896760238080 https://twitter.com/miltinh0c/status/1392944896760238080