Good article! Stopping this kind of threat without a layered security approach is almost impossible. Information Security best practices say that we must block access to malicious or unknown websites. We ended up relying on websites categories to do that since it is not possible to allow access based on a per site policy. Maybe considering this new sort of vector it would be a good idea creating an IPS signature to block any HTTP request that contains data after the IEND tag which typically marks the end of the image file.