Comment by Animats

The real attack is via Adobe Flash. The image thing is only to get past some virus scanners.

There have been so many vulnerabilities in Adobe Flash one has to wonder if they're deliberate. It's not a large body of code, after all.