Loading story…
Attackers are increasingly abusing Scalable Vector Graphics (SVG) email attachments as active initial-access payloads rather than harmless images. Because SVG is XML that browsers can interpret, a file opened locally can embed scripts, display full-screen credential-phishing content, reconstruct smuggled archives, or silently redirect a victim without placing a conspicuous URL in the email body. One analyzed sample concealed a Base64-encoded iframe containing obfuscated JavaScript that reversed and transformed encoded data into a destination URL before redirecting the browser; the file had four VirusTotal detections at the time of analysis.
SVG-based campaigns surged during 2026, including a Microsoft-observed operation that sent 1.2 million messages to more than 53,000 organizations, while telemetry showed a sharp increase in SVG detections in August. Most campaigns conduct broad credential theft, but targeted activity in Latin America, particularly Colombia, has used judicial and tax-themed lures to deliver AsyncRAT, Remcos, and DCRat. Organizations should treat SVG attachments as executable active content, inspect their XML and embedded objects, and apply layered email filtering, attachment sandboxing, endpoint controls, and web protections.
Get the infrastructure and lures behind it.
8 events from the most recent confirmed update back to the earliest known activity.
The first half of September recorded 9,659 SVG-attributed detections, corresponding to a rate roughly 70% higher than the June and July average.
SVG-attributed detections rebounded to 26,433, nearly double the preceding six-month average and 142% above the June trough.
A voicemail-themed SVG campaign generated approximately 26,500 detections across 5,500 organizations during the June-to-August period.
Reported SVG-attributed detections declined to 10,909, representing a 60% decrease from October 2025 across eight months. The decline was assessed as attackers rotating attachment formats rather than abandoning SVG attacks.
Microsoft observed an SVG phishing campaign that sent 1.2 million messages to more than 53,000 organizations across 23 countries. The campaign used a CAPTCHA gate followed by a fake sign-in page.
Reported SVG-attributed detections reached 27,443, a level later used as the starting point for an eight-month decline in detections.
Microsoft stopped rendering inline SVG content in Outlook, limiting that delivery route. Conventional SVG attachments could still be delivered and opened directly in a browser.
A malicious SVG was found to embed a Base64-encoded iframe and obfuscated JavaScript that reconstructs a destination URL and redirects the browser. The sample had four VirusTotal detections, while its destination site was unreachable at the time of analysis.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers warned that attackers are increasingly weaponizing **SVG** files by embedding JavaScript and other active content into files that are often treated as harmless images. Recent campaigns used malicious SVG attachments and links for **phishing**, **credential harvesting**, **malware delivery**, and **browser-based abuse**, including fake voicemail lures, self-contained phishing pages rendered directly from the SVG, and redirectors that sent victims to attacker-controlled domains. Analysis of recent samples found SVGs capable of obfuscated script execution, DOM manipulation, data exfiltration, and other in-browser actions that can bypass traditional defenses focused on conventional executables. Researchers linked one SVG-delivered script to a WordPress browser brute-force abuse pattern previously observed in 2024, while 2026 activity more commonly relied on redirects and embedded phishing content. Defenders were urged to treat SVGs as **active executable content**, inspect them for embedded scripts, and strengthen email and web filtering; published indicators included **three domains** and **22 SHA-1 hashes** tied to the activity.
Jul 23, 2026
A sophisticated phishing campaign has been identified targeting users in Colombia by impersonating official judicial notifications from the 17th Municipal Civil Court of the Bogotá Circuit. The attackers crafted emails in Spanish, leveraging local institutional details to increase the credibility of the lure. The phishing emails claim to contain a lawsuit notification and prompt recipients to open an attached SVG file. This SVG file is weaponized to initiate a multi-stage infection chain. Upon opening, the SVG file triggers the execution of a malicious HTA (HTML Application) file, which is a common technique for bypassing traditional email security filters. The HTA file then executes a VBS (Visual Basic Script) file, which in turn runs a PowerShell script. This PowerShell script acts as a downloader and loader, ultimately injecting the AsyncRAT remote access trojan into a legitimate Windows process to evade detection. AsyncRAT is a well-known remote access tool that allows attackers to gain persistent control over infected systems, exfiltrate data, and potentially deploy additional payloads. The campaign employs anti-virtual machine techniques to avoid analysis and uses persistence mechanisms to maintain access on compromised hosts. Security researchers have observed that the use of SVG files for initial infection is increasing, as these files can bypass some security controls due to their perceived harmlessness. The campaign demonstrates a high level of technical sophistication, chaining multiple scripting languages and file types to obfuscate the attack and evade endpoint detection. The malicious files have been identified and their MD5 hashes documented for threat intelligence sharing. Detection signatures have been updated by security vendors such as Quick Heal and Seqrite to identify and block the components of this attack. The campaign is notable for its targeted approach, focusing on Colombian users and leveraging local judicial terminology to increase the likelihood of success. The use of AsyncRAT as the final payload provides attackers with extensive capabilities for surveillance, data theft, and further lateral movement within affected organizations. Security teams are advised to educate users about the risks of opening unexpected attachments, especially those purporting to be from legal or government institutions. Organizations should also ensure that email security solutions are updated to detect SVG-based threats and that endpoint protection is capable of identifying the multi-stage infection chain. The incident highlights the evolving tactics of threat actors in using file formats and social engineering tailored to specific regions and institutions.
Jun 29, 2026
Microsoft Threat Intelligence identified a sophisticated phishing campaign targeting U.S.-based organizations, leveraging artificial intelligence to craft highly convincing and evasive attacks. The campaign was detected in late August 2025 and involved the use of compromised small business email accounts to distribute phishing emails. These emails masqueraded as legitimate file-sharing notifications, enticing recipients to open an attachment that appeared to be a PDF but was actually a Scalable Vector Graphics (SVG) file. The attackers exploited the SVG format's flexibility, embedding dynamic and interactive code that could bypass many traditional security tools. Instead of using standard obfuscation techniques, the malicious payload was hidden within the SVG file by encoding it with a sequence of business-related terms, such as 'revenue,' 'operations,' and 'risk,' making the file appear as standard business data. This approach allowed the attackers to disguise the true intent of the file, which was to redirect users to a fake sign-in page designed to harvest credentials. Microsoft noted that the code within the SVG was likely generated or enhanced using large language models (LLMs), a form of AI that can produce complex, human-like text and code, further complicating detection efforts. The phishing emails also employed a self-addressed tactic, where the sender and recipient addresses matched, with actual targets hidden in the BCC field to evade basic detection heuristics. SVG files are particularly attractive to attackers because they are text-based, scriptable, and support features like invisible elements, encoded attributes, and delayed script execution, all of which can be used to sidestep static analysis and security scanning. Microsoft responded by using its own AI-powered security tools to analyze and block the campaign, highlighting the growing trend of AI versus AI in cybersecurity defense and offense. The campaign underscores the increasing adoption of AI by threat actors to automate the creation of convincing phishing lures and obfuscated malware. The use of compromised business email accounts added legitimacy to the phishing attempts, increasing the likelihood of successful credential theft. The incident demonstrates the evolving threat landscape, where attackers continuously adapt their methods to outpace security defenses. Organizations are advised to enhance their email security protocols, educate users about the risks of unexpected file attachments, and deploy advanced detection tools capable of analyzing complex file formats like SVG. The campaign serves as a warning that traditional security measures may be insufficient against AI-driven threats, necessitating a proactive and adaptive security posture. Microsoft’s public disclosure of the attack provides valuable intelligence for defenders to recognize and mitigate similar threats in the future. The incident also highlights the importance of monitoring for unusual email behaviors, such as self-addressed messages and unexpected file types. As AI becomes more accessible to both attackers and defenders, the arms race in cybersecurity is expected to intensify, with increasingly sophisticated attacks targeting organizations of all sizes.
Jun 29, 2026