favicon obfuscation

A favicon is a code execution primitive.

How attackers hide skimmers and full payloads in favicon files, why MIME and CSP misconfiguration lets image bytes run as code, and what defenders miss.