[interested_observer]

Researchers have discovered a relatively new way to distribute malware that relies on reading JavaScript code stored in an obfuscated PNG file’s metadata to trigger iFrame injections.

The technique makes it highly unlikely a virus scanner would catch it because the injection method is so deeply engrained in the image’s metadata.

• PNG Image Metadata Found Leveraging iFrame Injections | Threatpost - English - Global - threatpost.com

The first and only comment only makes this attack worse, in that there is no actual code to scan since the attack code actually resides and executes on the attacker's web page. That just makes being notified of unsafe web sites all the more important.

[Tsukiouji]

there is no actual code to scan since the attack code actually resides and executes on the attacker's web page.

Since most antivirus software already have web-modules to protect it's users from internet attacks, I really see no problem here.