Not only does it carry the complete code but both image and the Javascript are seen as valid. With just a little bit of work [jklmnn] boiled down the concept to the most basic parts so that it is ...

Researchers have discovered a relatively new way to distribute malware that relies on reading malicious obfuscated JavaScript code stored in a PNG file’s metadata to trigger iFrame injections.