Security experts say favicons are being used to hide signed update files of Vawtrak malware. Once inside a users system, it can steal a wide range of passwords using a malware module called Pony. Cybercriminals are connecting to servers hidden on the Tor network using a proxy service to update the malware. The use of Tor to keep cybercriminals infrastructure under the radar is also becoming standard practice. The threat is by no means a new threat, but it is another example of how cyber criminals treat malware as a product to be improved over time.”]
Source: https://securityintelligence.com/news/vawtrak-variant-uses-favicons-hide-dangerous-malware-files/