I wrote a small javascript function to show images in a popup window. The code is below.<BR><BR><pre class="ip-ubbcode-code-pre">function imgpop(imgLocation){ ...

The authors turned to polyglot images to add the JavaScript code that redirects to a page offering a fake reward. The malicious code is hidden in a BMP type of picture and it is heavily obfuscated.