Full Report
Sophos has observed cybercriminals ramping up their use of graphics files as part of email phishing attacks to bypass conventional security protections
Analysis Summary
# Tool/Technique: Malicious Scalable Vector Graphics (SVG) Attachments
## Overview
The use of Scalable Vector Graphics (SVG) files as email attachments containing malicious links to facilitate phishing attacks. This tactic aims to bypass conventional email and endpoint security tools by leveraging the SVG format's structure, which may be less scrutinized than traditional executable or script file types.
## Technical Details
- Type: Technique/Delivery Mechanism
- Platform: Windows computers (for default browser opening)
- Capabilities: Hosting hyperlinks, embedding active web content (scripting/anchor tags), ability to render complex graphics for brand impersonation.
- First Seen: Late 2024, accelerating mid-January 2025
## MITRE ATT&CK Mapping
- T1566 - Phishing
- T1566.001 - Spearphishing Attachment
- T1566.002 - Spearphishing Link
- T1204 - User Execution
- T1204.002 - Malicious File
## Functionality
### Core Capabilities
- **Delivery:** Sent as email attachments, often disguised with lures related to voicemails, contracts, or payment confirmations.
- **Redirection:** Contain anchor tags (`<a>` elements) that link to attacker-controlled, external web pages.
- **Impersonation:** Can draw shapes and graphics to visually mimic legitimate services (e.g., DocuSign, SharePoint, Google Voice).
### Advanced Features
- **Obfuscation:** The structure of SVG (XML-like text instructions) can be used to conceal or obfuscate malicious content in ways that certain content scanning technologies fail to recognize.
- **Phishing Page Integration:** Redirected pages often utilize CloudFlare CAPTCHA to deter automated analysis.
- **Credential Harvesting:** The resulting phishing pages meticulously fake login dialogs (e.g., Office365 login, prefetching content from `login.live.com`) to capture credentials, sometimes exfiltrating them directly to the hosting domain or even via a Telegram bot API.
- **MFA Bypass Context:** This technique exists within the context of attackers increasingly adept at bypassing MFA protections via sophisticated phishing pages (e.g., those leveraging ADFS spoofing).
## Indicators of Compromise
- File Hashes: [Not specified in the text]
- File Names: Varies based on lure (e.g., voicemail notification, contract)
- Registry Keys: [Not specified in the text]
- Network Indicators: Phishing pages hosted on attacker-controlled domains, often protected by CloudFlare CAPTCHA. Credentials exfiltrated to the hosting domain or a Telegram bot (using Telegram API).
- Behavioral Indicators: User clicking on an embedded link within an SVG file opened in a web browser; subsequent attempts to authenticate via a spoofed login page.
## Associated Threat Actors
- Generic cybercriminals leveraging novel phishing techniques.
## Detection Methods
- **Signature-based detection:** Standard scanners may fail if the malicious payload/link structure within the SVG is novel or obfuscated.
- **Behavioral detection:** Monitoring for user execution of unexpected SVG files that subsequently attempt to navigate to external, high-risk domains or interact with login dialogs.
- **YARA rules:** Potential for rules targeting specific XML patterns or embedded known malicious URLs/scripts within the SVG content.
## Mitigation Strategies
- **Email Gateway Inspection:** Configure email security gateways to thoroughly inspect and potentially block SVG attachments, regardless of file type classification, due to their capacity to execute active content.
- **Endpoint Security:** Ensure endpoint protection is capable of analyzing the behavior resulting from opening seemingly innocuous files like SVGs in a browser context.
- **User Training:** Educate users on the risks associated with unexpected attachments, especially those purporting to be from common services, and advise against clicking embedded links.
- **Browser Security:** Ensure browser security settings minimize the execution risks associated with active content embedded in newly downloaded files.
## Related Tools/Techniques
- Malicious QR Code delivery (designed to evade OCR).
- Exploitation of configuration settings in email protection services (e.g., Proofpoint SPF/DKIM spoofing).
- Use of Google Calendar/Drawings for malicious link delivery.
- Phishing pages leveraging ADFS spoofing to bypass MFA.