10 minmedium
Hidden in plain sight: How SVGs carry malicious scripts
Threat actors are increasingly weaponizing SVG files by embedding JavaScript that executes automatically in browsers, enabling phishing redirects, credential harvesting, and DOM-based attacks. ReversingLabs analyzed malicious SVG samples from 2026 spearphishing campaigns using fake voicemail attachments to redirect targets in healthcare, construction, and banking to malicious domains. Additional samples showed SVGs acting as full webpages loading external brute-force scripts, demonstrating the versatility of SVG-based attacks that bypass traditional security controls treating SVGs as benign images.
Sens:▲ 24hConf:
Showing defanged values
- domain01058telecom[.]deMalicious redirect domain extracted from deobfuscated SVG voicemail phishing attachment
- domainqedhsp[.]cprltdf[.]esMalicious redirect domain extracted from deobfuscated SVG voicemail phishing attachment
- domainwihportal[.]sbsMalicious redirect domain extracted from deobfuscated SVG voicemail phishing attachment
- sha10d289ae3837acc7d076b770b6cec2a1d8b0fabf0Malicious SVG file hash from ReversingLabs analysis
- sha1177122bdcc5dc1ddd38a01c68b4b7c627c7a50b0Malicious SVG file hash from ReversingLabs analysis
- sha12b081fb89d88c93ee5339d33eb3200b69d5f3b8bMalicious SVG file hash from ReversingLabs analysis
- sha12b48a6c9cfb3932021c7c4b567199f57802ad018Malicious SVG file hash from ReversingLabs analysis
- sha131652250f9e4f67579a3e187806ba2cfad1792dbMalicious SVG file hash from ReversingLabs analysis
- sha13734b0314f01293b36efb9fbff133a332ab9d6b0Malicious SVG file hash from ReversingLabs analysis
- sha15fa626b691613abbcc0eed2d143c3a485853d8d9Malicious SVG file hash from ReversingLabs analysis
- sha1771151e26a5e7d3198d3b28a919e802965482d39Malicious SVG file hash from ReversingLabs analysis
- sha17d4daac63543a754ee43cfc4e812040e6ed32ac9Malicious SVG file hash from ReversingLabs analysis
- sha1806d8283de91c116f2c56ad0aa4c7ae0b33de626Malicious SVG file hash from ReversingLabs analysis
- sha1955dbf23d53832f5f1c514b116a5cc04ccc635ecMalicious SVG file hash from ReversingLabs analysis
- sha197f5bfb2f8c2aa240d52345c54ef2e99b760c16eMalicious SVG file hash from ReversingLabs analysis
- sha1997ca1f4d9e94293ddaed0a63968fd25c19e8a6cMalicious SVG file hash from ReversingLabs analysis
- sha1bf978f20fd2320645bda61a78ef7d652130394a1Malicious SVG file hash from ReversingLabs analysis
- sha1c5329cfae6d94b2ba9dddaa20b1725a51104581cMalicious SVG file hash from ReversingLabs analysis
- sha1cb53af4fbf24936590f5092f717661d3579d50deMalicious SVG file hash from ReversingLabs analysis
- sha1d632cad92dd560374eef427930cbef562b309067Malicious SVG file hash from ReversingLabs analysis
- sha1d9e4ae7bf23b5c6691156a6fa7fb128ea6890584Malicious SVG file hash from ReversingLabs analysis
- sha1df9582a020b87af2ab67aeeb9cd48e63a1c7fa3eMalicious SVG file hash from ReversingLabs analysis
- sha1e01739c067950beb1a877b54401ae2a47962b61cMalicious SVG file hash from ReversingLabs analysis
- sha1eec21fc0c0163117039b1cc2a9209ade788f4d64Malicious SVG file hash from ReversingLabs analysis
- sha1effcc8433a07fb9e1b1cc2efa621487d62315177Malicious SVG file hash from ReversingLabs analysis
- urlhxxps://dynamic-linx[.]com/chx[.]jsExternal brute-force script loaded by malicious SVG webpage, associated with 2024 WordPress password brute-forcing attacks
- urlhxxps://hostpdf[.]co/pinche[.]phpExfiltration endpoint receiving search bar inputs and captured data from malicious SVG-based gambling webpage
Detection / Hunteropenrouter
What Happened
Attackers are hiding malicious code inside SVG image files, a format most people and security tools assume is harmless. When someone opens one of these images in a web browser, the hidden code runs automatically and can redirect them to fake websites, steal their passwords, or carry out other attacks. In early 2026, researchers found a wave of fake voicemail email attachments that were actually malicious SVG files targeting people in healthcare, construction, and banking. Some SVG files even acted as complete fake websites that secretly forced the victim's browser to try cracking passwords on other sites. Organizations should filter email attachments that are SVG files, train employees to be cautious, and use multi-factor authentication to protect against credential theft.
Key Takeaways
- SVG files can embed JavaScript that executes automatically in browsers, making them a novel malware delivery vector often overlooked by security solutions that treat SVGs as benign images
- Three primary attack types observed: redirectors (redirect to malicious sites), self-contained phishing pages (credential harvesting within the SVG itself), and DOM injection/script abuse (XSS or direct malicious command execution)
- 2026 spearphishing campaigns use SVG attachments masquerading as voicemail notifications, targeting healthcare, construction, and banking industries with specific individuals like CEOs and financial managers
- One SVG-based gambling website was found loading a WordPress brute-force script (chx.js) associated with 2024 attacks, demonstrating SVGs can act as full webpages with malicious external script loading
- Attackers use various encoding and obfuscation methods including Base64, hex-encoded payloads with XOR-style decryption, and code fragmentation to evade detection of redirect domains
Affected Systems
- Web browsers (JavaScript execution enabled by default)
- Email clients receiving SVG attachments
- WordPress sites (targeted by brute-force script loaded via malicious SVGs)
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Spearphishing emails deliver SVG attachments masquerading as voicemail notifications targeting specific individuals in healthcare, construction, and banking
- Execution: Victim opens SVG file in browser; embedded JavaScript executes automatically by default browser settings
- Obfuscation: Redirect domains encoded using Base64, hex payloads with XOR-style decryption, or code fragmentation to evade security detection
- Redirection/Phishing: SVG redirects victim to attacker-controlled domain or renders self-contained phishing page within the SVG itself
- Credential Harvesting: Fake login pages or input capture scripts exfiltrate entered credentials to attacker-controlled endpoints
- Exfiltration: Captured data sent via POST requests to attacker servers (e.g., pinche.php) or used for further attacks like WordPress brute-forcing
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
No detection rules are provided in the article. The analysis is descriptive, covering attack methodology and IOCs but not including specific detection logic.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | SVG-based attacks primarily execute JavaScript within browser contexts, which may not be directly visible to EDR solutions focused on process-level telemetry. The malicious activity occurs within the browser's JavaScript engine rather than spawning traditional processes. |
| Network Visibility | Medium | Network-based detection could identify POST requests to exfiltration endpoints and connections to known malicious domains. However, if the SVG is opened locally and the redirect uses encoded/obfuscated domains, initial network visibility may be limited until the redirect occurs. |
| Detection Difficulty | Hard | SVG files are commonly treated as benign images by security solutions. The embedded JavaScript uses various obfuscation techniques including Base64 encoding, hex-encoded payloads, and code fragmentation. Detection requires content inspection of SVG XML for script tags and behavioral analysis of JavaScript execution within browser contexts. |
Required Log Sources
- Email gateway logs with attachment type filtering
- Web proxy logs for outbound connections to malicious domains
- DNS resolution logs for redirect domain lookups
- Browser security logs if available
- Network flow data for POST requests to exfiltration endpoints
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for SVG files received as email attachments, particularly those containing embedded script tags or JavaScript event listeners, as these may indicate malicious SVG-based phishing attempts. | Email gateway logs, attachment scanning logs, file content inspection of SVG XML for <script> elements | Initial Access | Medium - legitimate SVG files may contain JavaScript for interactive animations or legitimate web content |
| Consider hunting for outbound POST requests to endpoints associated with input exfiltration from SVG-based webpages, particularly if the user recently opened an SVG file. | Web proxy logs, network flow data, DNS resolution logs | Exfiltration | Low - specific exfiltration endpoints with POST patterns are unlikely to match legitimate traffic |
| Consider hunting for browser connections to domains associated with WordPress brute-force scripts, particularly if initiated from an SVG file context, as this may indicate the chx.js attack pattern. | Web proxy logs, DNS logs, browser extension telemetry if available | Execution | Low - the specific script URL pattern is unlikely to appear in legitimate browsing |
| Consider hunting for SVG files that contain obfuscated JavaScript patterns such as hex-encoded strings with XOR decryption loops or Base64-encoded redirect URLs, as these are consistent with the observed attack techniques. | File content inspection, email attachment scanning, endpoint file creation events for .svg files | Execution | Medium - some legitimate SVG applications may use encoding for asset optimization |
Control Gaps
- Email security gateways that do not inspect SVG file contents for embedded JavaScript
- Endpoint security solutions that classify SVG files as benign images without content analysis
- Web content filters that do not block or analyze SVG-rendered phishing pages
- Browser default settings that execute embedded JavaScript in SVGs without user consent
Key Behavioral Indicators
- SVG files containing <script> tags with obfuscated JavaScript assignments to window properties
- SVG files with embedded HTML form elements and input capture event listeners
- SVG files containing hex-encoded payloads with XOR-style decryption routines
- SVG email attachments with Base64-encoded email addresses targeting specific individuals
- SVG files with comments indicating AI-generated code or image generator tools like Inkscape/LibreOffice but lacking actual image rendering code
- Browser processes making POST requests to external endpoints shortly after opening an SVG file
False Positive Assessment
Medium - Legitimate SVG files may contain JavaScript for interactive animations and web content. Detection based solely on the presence of script tags in SVGs would generate false positives. Contextual factors such as email delivery vector, obfuscation patterns, and known malicious infrastructure should be combined with content inspection to reduce false positives.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider filtering or quarantining all inbound email attachments with .svg file extensions, as legitimate business use of SVG attachments via email is rare.
- Consider adding the identified malicious domains (01058telecom.de, qedhsp.cprltdf.es, wihportal.sbs) to your DNS blocklists and web proxy deny lists if supported by your infrastructure.
- If your email gateway supports content inspection, consider implementing rules to scan SVG files for embedded <script> tags and block or quarantine those containing JavaScript.
- Consider blocking the identified exfiltration URLs (hostpdf.co/pinche.php, dynamic-linx.com/chx.js) at your web proxy or firewall if applicable.
Infrastructure Hardening
- Evaluate whether your email security solution can inspect SVG file contents for embedded JavaScript and consider enabling deep content inspection for image-type attachments if available.
- Consider implementing browser policies that disable JavaScript execution in SVG files opened locally or restrict SVG rendering to trusted domains only.
- If you manage WordPress sites, consider implementing rate limiting and login protection measures to mitigate brute-force attacks that may be driven by malicious SVG-loaded scripts.
- Evaluate whether your web content filtering solution can detect and block SVG-rendered phishing pages that use HTML, CSS, and JavaScript within the SVG XML structure.
User Protection
- Consider deploying or reinforcing multi-factor authentication (OTP, FIDO keys) for all user accounts, as many SVG attacks ultimately redirect to or directly act as credential harvesting phishing sites.
- If your endpoint protection supports it, consider enabling enhanced monitoring for browser processes that open local SVG files and subsequently make outbound network connections.
- Consider deploying browser extensions or policies that warn users when opening local files that contain executable content such as JavaScript.
Security Awareness
- Consider adding SVG-based phishing to existing security awareness training programs, emphasizing that image files can contain executable code.
- Educate users to be suspicious of voicemail notification emails with SVG attachments, particularly those targeting specific roles like CEOs, financial managers, and administrative staff.
- Consider reminding users that SVG files are not standard voicemail attachment formats and any such attachment should be treated with suspicion.
- If applicable to your organization, consider training users to report SVG email attachments to the security team rather than opening them.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping5 techniques
Tactic
Initial Access
Tactic
Execution
Tactic
Stealth
Tactic
Credential Access
Tactic
Collection
Additional IOCs
- File Hashes:
d9e4ae7bf23b5c6691156a6fa7fb128ea6890584(SHA1) - Malicious SVG file hash from ReversingLabs analysis0d289ae3837acc7d076b770b6cec2a1d8b0fabf0(SHA1) - Malicious SVG file hash from ReversingLabs analysisd632cad92dd560374eef427930cbef562b309067(SHA1) - Malicious SVG file hash from ReversingLabs analysisc5329cfae6d94b2ba9dddaa20b1725a51104581c(SHA1) - Malicious SVG file hash from ReversingLabs analysis771151e26a5e7d3198d3b28a919e802965482d39(SHA1) - Malicious SVG file hash from ReversingLabs analysiseffcc8433a07fb9e1b1cc2efa621487d62315177(SHA1) - Malicious SVG file hash from ReversingLabs analysis31652250f9e4f67579a3e187806ba2cfad1792db(SHA1) - Malicious SVG file hash from ReversingLabs analysis2b081fb89d88c93ee5339d33eb3200b69d5f3b8b(SHA1) - Malicious SVG file hash from ReversingLabs analysis806d8283de91c116f2c56ad0aa4c7ae0b33de626(SHA1) - Malicious SVG file hash from ReversingLabs analysis5fa626b691613abbcc0eed2d143c3a485853d8d9(SHA1) - Malicious SVG file hash from ReversingLabs analysis139ec3c1b4fae48fc5d6e0d4957516f0c20633f(SHA1) - Malicious SVG file hash from ReversingLabs analysis (possibly truncated)97f5bfb2f8c2aa240d52345c54ef2e99b760c16e(SHA1) - Malicious SVG file hash from ReversingLabs analysis3734b0314f01293b36efb9fbff133a332ab9d6b0(SHA1) - Malicious SVG file hash from ReversingLabs analysis177122bdcc5dc1ddd38a01c68b4b7c627c7a50b0(SHA1) - Malicious SVG file hash from ReversingLabs analysis955dbf23d53832f5f1c514b116a5cc04ccc635ec(SHA1) - Malicious SVG file hash from ReversingLabs analysiscb53af4fbf24936590f5092f717661d3579d50de(SHA1) - Malicious SVG file hash from ReversingLabs analysisdf9582a020b87af2ab67aeeb9cd48e63a1c7fa3e(SHA1) - Malicious SVG file hash from ReversingLabs analysis7d4daac63543a754ee43cfc4e812040e6ed32ac9(SHA1) - Malicious SVG file hash from ReversingLabs analysise01739c067950beb1a877b54401ae2a47962b61c(SHA1) - Malicious SVG file hash from ReversingLabs analysisbf978f20fd2320645bda61a78ef7d652130394a1(SHA1) - Malicious SVG file hash from ReversingLabs analysis2b48a6c9cfb3932021c7c4b567199f57802ad018(SHA1) - Malicious SVG file hash from ReversingLabs analysiseec21fc0c0163117039b1cc2a9209ade788f4d64(SHA1) - Malicious SVG file hash from ReversingLabs analysis997ca1f4d9e94293ddaed0a63968fd25c19e8a6c(SHA1) - Malicious SVG file hash from ReversingLabs analysis
- Other:
08fd9298f79ad3de545ec218- Hex decryption key used in malicious SVG JavaScript decryption routine to decode embedded payload
Related
Stay currentSubscribe via RSS