Cybersecurity researchers have uncovered a sophisticated phishing method that leverages SVG (Scalable Vector Graphics) files to stealthily deliver malicious HTML content to unsuspecting users.
First detected in early 2025, this evolving threat highlights a significant shift in phishing tactics. Attackers are now exploiting the hybrid nature of SVG files—capable of embedding both graphics and code—to evade traditional security defenses and deceive victims into disclosing sensitive information.
Unlike traditional image formats like JPEG or PNG, SVG files are based on XML markup, allowing them to embed JavaScript and HTML code.
Originally designed to support interactive graphics, this legitimate feature has been repurposed by malicious actors to embed phishing pages or redirection scripts within seemingly innocent image files.
Attack Vector Overview
The phishing campaign typically begins with an email containing an SVG attachment disguised as something benign—often presented as an audio recording or a document requiring a signature.
Once opened, the embedded code within the SVG file is triggered. It either displays a fraudulent HTML page directly or uses JavaScript to redirect the victim to a highly convincing phishing site that mimics trusted services like Google Voice or Microsoft login portals.
Researchers at Securelist observed a notable surge in this tactic during March 2025, documenting 2,825 phishing emails leveraging SVG attachments in Q1 alone. The trend has continued into April, with 1,324 incidents recorded in just the first two weeks—signaling the growing effectiveness of this method against conventional security defenses.
Infection Mechanism Analysis
The technical approach behind these attacks is deceptively simple. Upon inspection, many malicious SVG files contain little to no actual vector graphics. Instead, they embed full HTML documents or JavaScript-based redirection logic within the SVG structure.
One analyzed sample included obfuscated JavaScript, such as:
javascriptCopyEditString.fromCharCode(HicRzF.charCodeAt(0) + (HiCRzF...
]]>
When such an SVG is opened in a browser, it immediately executes the embedded code—either rendering a fake login page directly within the file or redirecting the user to an external malicious site where credentials can be harvested.
This tactic is particularly effective because the file retains its “.svg” extension and is classified as image/svg+xml in email headers. As a result, it often bypasses traditional attachment filters, which tend to block executable formats or standard HTML attachments but overlook SVG files.
