Adult Sites Are Hiding Malware in Sexy Images That Secretly Hijack Facebook Likes Behind Your Back

It turns out that not all images are as innocent—or as naughty—as they seem. Dozens of adult websites have been caught embedding malware into .svg image files that trick your browser into secretly liking their Facebook content without you even noticing. Yep, your browser might be working behind your back to like X-rated posts while you sip your coffee.

The Malware Is in the Vector

These stealth attacks are baked into .svg files—Scalable Vector Graphics. If you’ve worked with graphics or web pages, you might know these are text-based image files that don’t pixelate no matter how much you zoom in. They’re great for web designers.

But here’s the problem: because .svg files use XML text, they can quietly sneak in code like HTML and JavaScript. That opens the door to all sorts of shady business, including browser hijacking, phishing attacks, and now, invisible Facebook engagement.

What’s Actually Happening?

Photo by Google DeepMind on Unsplash

Security researchers at Malwarebytes recently uncovered a network of adult sites—built on WordPress—that are loading these .svg images with booby-trapped JavaScript. When a user clicks on one of these images, it sets off a chain reaction:

1. The click triggers an initial hidden script.
2. That script loads more heavily disguised JavaScript.
3. The final payload is a known baddie: Trojan.JS.Likejack.

As Malwarebytes’ Pieter Arntz explains, this nasty little script takes advantage of users who already have Facebook open. Without any popup or prompt, the script sends a silent “Like” to specific Facebook posts promoting the adult content. All behind the scenes. No confirmation. No clue it happened.

“It silently clicks a ‘Like’ button for a Facebook page without the user’s knowledge or consent,” Arntz wrote. So if your Facebook feed suddenly starts recommending more risqué content, you might want to double-check the last few shady image links you clicked.

Obfuscated Code, Hidden in Plain Sight

What makes this even sneakier is that the JavaScript is obscured using a technique called “JSFuck.” It’s as ridiculous as it sounds—a way of encoding JavaScript with just a tiny set of characters, making it almost impossible to read or recognize by eye. It looks like gibberish, but it works like a charm for attackers.

Once decoded by researchers, it became clear that the code’s whole purpose was to drive more engagement to these adult sites by exploiting users’ logged-in Facebook sessions. Essentially, boosting visibility with fake likes.

This Isn’t the First Time SVGs Were Used for Mischief

Photo by Mika Baumeister on Unsplash

SVG misuse isn’t exactly new. In 2023, a pro-Russian hacking group used SVG tags to exploit a mail app used by millions. And earlier this year, SVGs were tied to a phishing scam that displayed fake Microsoft login screens. So while the format has genuine uses, it’s clearly become a favorite among cybercriminals too.

What You Can Do About It

The best way to stay safe?

• Don’t click on suspicious image links—especially if they’re hosted on adult sites.
• Keep your security software (like Malwarebytes or any trusted scanner) running and up-to-date.
• Consider logging out of Facebook when you’re not using it.
• And if you suddenly notice weird “Likes” on your Facebook activity, do a double-check on your browser history.

This SVG-turned-malware trend is another reminder that even simple things like images aren’t always what they seem online. Behind the curves, there might just be a script waiting to mess with your clicks.

Stay sharp, and maybe skip clicking that “hot singles in your area” banner.