{"id":5416,"date":"2025-07-17T10:05:29","date_gmt":"2025-07-17T10:05:29","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/07\/17\/threat-actors-weaponizing-svg-files-to-embed-malicious-javascript\/"},"modified":"2025-07-17T10:05:29","modified_gmt":"2025-07-17T10:05:29","slug":"threat-actors-weaponizing-svg-files-to-embed-malicious-javascript","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/07\/17\/threat-actors-weaponizing-svg-files-to-embed-malicious-javascript\/","title":{"rendered":"Threat Actors Weaponizing SVG Files to Embed Malicious JavaScript"},"content":{"rendered":"

Threat Actors Weaponizing SVG Files to Embed Malicious JavaScript
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

Threat actors are quietly turning Scalable Vector Graphics (SVG) files into precision-guided malware. In a surge of phishing campaigns, seemingly innocuous .svg<\/code> attachments slip past secure email gateways because mail filters regard them as static images.<\/p>\n

Once the recipient merely previews the file, hidden JavaScript executes inside the browser, triggering an invisible redirect chain that funnels victims to attacker infrastructure.<\/p>\n

\n
\"\"
The Recipient\u2019s perspective (Source \u2013 Ontinue)<\/figcaption><\/figure>\n<\/div>\n

The lure emails are minimalist\u2014often a single icon or \u201cMissed Call\u201d<\/strong> teaser\u2014and exploit organisations that have weak SPF, DKIM or DMARC enforcement.<\/p>\n

As the attachments bypass signature checks, the first line of defence fails; Ontinue analysts identified<\/a> the wave after correlating near-identical SVGs sent to B2B service providers and SaaS vendors, all containing distinct Base64 tracking strings that map each click to a workstation.<\/p>\n

Since no executable is dropped, endpoint agents see only normal browser activity while credentials are siphoned off on well-crafted Microsoft 365 look-alike portals.<\/p>\n

\n
\"\"
Typical M365 Credential Phishing (Source \u2013 Ontinue)<\/figcaption><\/figure>\n<\/div>\n

Beyond credential theft<\/a>, the technique exemplifies a broader strategic pivot: adversaries increasingly weaponise file formats that browsers render natively, removing the social-engineering friction of persuading users to run macros or installers.<\/p>\n

Security controls that focus on executables, archives or scripts alone find themselves blind to these pixel-perfect stings.<\/p>\n

Infection Mechanism: Self-Decoding JavaScript Smuggling<\/strong><\/h2>\n

Each malicious SVG embeds an obfuscated<\/a> payload between \u201c tags. A ten-byte XOR key masks the script, frustrating static scanners, while a two-stage routine reconstructs the redirect at runtime.<\/p>\n

First, a short function iterates through the encrypted blob, returning plaintext; then it leverages the Function<\/code> constructor to execute that code entirely in memory.<\/p>\n

The revived script concatenates an atob()<\/code>-decoded domain with a victim-specific token before forcing navigation:-<\/p>\n

window.location.href = atob(\n  'aHR0cHM6Ly93dnJ6LmxmdGt2b2cubmV0L...' \/\/ domain rotates daily\n) + token;<\/code><\/pre>\n
As nothing is written to disk, persistence is irrelevant, and geofencing logic ensures sandboxes outside the target region receive benign pages.<\/p>\n
Detecting the threat therefore hinges on deep content inspection that flags script tags inside image files or on correlating unusual .svg<\/code> command-line invocations with email telemetry.<\/p>\n
Until such controls mature, organisations should quarantine unsolicited SVGs, enable content disarm and reconstruction, and move DMARC policies from monitoring<\/a> to reject.<\/p>\n
Boost detection, reduce alert fatigue, accelerate response; all with an interactive sandbox built for security teams ->\u00a0Try ANY.RUN Now<\/a><\/strong><\/p>\n
The post Threat Actors Weaponizing SVG Files to Embed Malicious JavaScript<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n
 \t

\n 
<\/BR>
\n    Tushar Subhra Dutta
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n 
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"
Threat Actors Weaponizing SVG Files to Embed Malicious JavaScript Threat actors are quietly turning Scalable Vector Graphics (SVG) files into precision-guided malware. In a surge of phishing campaigns, seemingly innocuous .svg attachments slip past secure email gateways because mail filters regard them as static images. Once the recipient merely previews the file, hidden JavaScript executes […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,649],"tags":[130],"class_list":["post-5416","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-threats","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/5416"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=5416"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/5416\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=5416"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=5416"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=5416"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}