Researchers Detail How Attackers Use Malicious SVGs for Phishing and Redirects
Summary
ReversingLabs analyzed malicious SVG samples amid a reported early-2026 rise, finding JavaScript used for redirects, phishing pages and input collection. Researchers could not access sites linked by some voicemail-themed samples.
Key points
- Researchers describe three SVG attack patterns: redirects, self-contained phishing pages, and DOM or script abuse.
- One analyzed SVG acted as a webpage, generated a user ID, sent search-bar inputs to a server, and loaded an external script associated with WordPress password brute-forcing.
- A separate wave used SVG attachments masquerading as voicemail notices; some encoded target email addresses and obfuscated redirect domains.
- Targets included healthcare, construction and banking organizations, with addresses for departments such as administration and finance as well as senior personnel.
- Researchers extracted potentially malicious domains from the voicemail-themed samples but could not access the destination sites.
- The article recommends filtering email attachments in SVG format and using anti-phishing measures such as OTPs or FIDO keys.
Article Details
- Attack Vectors
- Malicious JavaScript embedded in SVG files was used to create redirectors, self-contained phishing pages, and scripts that interacted with webpage content.
- SVG attachments disguised as voicemail notices were used in spear-phishing attempts targeting healthcare, construction, and banking organizations.
- One SVG webpage collected search-bar inputs and sent them to an external page; another external script was associated with forcing victims’ browsers to brute-force WordPress passwords.
- Researchers found SVG redirectors that obscured destination domains through encoding, but could not access the destination-site contents.
- Defensive Notes
- Filter emails with SVG attachments and exercise caution when clicking image files or attachments.
- Use anti-phishing protections such as OTPs and FIDO keys.
- Do not treat SVG files as inherently benign; the article reports that security solutions may overlook malicious SVGs because they appear to be images.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | 01058telecom[.]de | Researchers extracted this as a potentially malicious redirect domain from SVG samples; they could not access its contents. |
| DOMAIN | qedhsp[.]cprltdf[.]es | Researchers extracted this as a potentially malicious redirect domain from SVG samples; they could not access its contents. |
| DOMAIN | wihportal[.]sbs | Researchers extracted this as a potentially malicious redirect domain from SVG samples; they could not access its contents. |
| SHA1 | 0d289ae3837acc7d076b770b6cec2a1d8b0fabf0 | Hash listed among samples analyzed as malicious SVG files. |
| SHA1 | 177122bdcc5dc1ddd38a01c68b4b7c627c7a50b0 | Hash listed among samples analyzed as malicious SVG files. |
| SHA1 | 2b081fb89d88c93ee5339d33eb3200b69d5f3b8b | Hash listed among samples analyzed as malicious SVG files. |
| SHA1 | 2b48a6c9cfb3932021c7c4b567199f57802ad018 | Hash listed among samples analyzed as malicious SVG files. |
| SHA1 | 31652250f9e4f67579a3e187806ba2cfad1792db | Hash listed among samples analyzed as malicious SVG files. |
| SHA1 | 3734b0314f01293b36efb9fbff133a332ab9d6b0 | Hash listed among samples analyzed as malicious SVG files. |
| SHA1 | 5fa626b691613abbcc0eed2d143c3a485853d8d9 | Hash listed among samples analyzed as malicious SVG files. |
| SHA1 | 771151e26a5e7d3198d3b28a919e802965482d39 | Hash listed among samples analyzed as malicious SVG files. |
| SHA1 | 7d4daac63543a754ee43cfc4e812040e6ed32ac9 | Hash listed among samples analyzed as malicious SVG files. |
| SHA1 | 806d8283de91c116f2c56ad0aa4c7ae0b33de626 | Hash listed among samples analyzed as malicious SVG files. |
| SHA1 | 955dbf23d53832f5f1c514b116a5cc04ccc635ec | Hash listed among samples analyzed as malicious SVG files. |
| SHA1 | 97f5bfb2f8c2aa240d52345c54ef2e99b760c16e | Hash listed among samples analyzed as malicious SVG files. |
| SHA1 | 997ca1f4d9e94293ddaed0a63968fd25c19e8a6c | Hash listed among samples analyzed as malicious SVG files. |
| SHA1 | bf978f20fd2320645bda61a78ef7d652130394a1 | Hash listed among samples analyzed as malicious SVG files. |
| SHA1 | c5329cfae6d94b2ba9dddaa20b1725a51104581c | Hash listed among samples analyzed as malicious SVG files. |
| SHA1 | cb53af4fbf24936590f5092f717661d3579d50de | Hash listed among samples analyzed as malicious SVG files. |
| SHA1 | d632cad92dd560374eef427930cbef562b309067 | Hash listed among samples analyzed as malicious SVG files. |
| SHA1 | d9e4ae7bf23b5c6691156a6fa7fb128ea6890584 | Hash listed among samples analyzed as malicious SVG files. |
| SHA1 | df9582a020b87af2ab67aeeb9cd48e63a1c7fa3e | Hash listed among samples analyzed as malicious SVG files. |
| SHA1 | e01739c067950beb1a877b54401ae2a47962b61c | Hash listed among samples analyzed as malicious SVG files. |
| SHA1 | eec21fc0c0163117039b1cc2a9209ade788f4d64 | Hash listed among samples analyzed as malicious SVG files. |
| SHA1 | effcc8433a07fb9e1b1cc2efa621487d62315177 | Hash listed among samples analyzed as malicious SVG files. |
MITRE ATT&CK
T1036 · MasqueradingMalicious SVG files were made to appear as benign images or voicemail attachments.T1056 · Input CaptureAn SVG script collected search-bar inputs and sent them to an external page.T1059.007 · JavaScriptMalicious actions were implemented using JavaScript embedded in SVG files.T1204 · User ExecutionVictims clicked SVG images or attachments to trigger redirects or other malicious behavior.T1566.001 · Spearphishing AttachmentSVG attachments masquerading as voicemail notices were used in spear-phishing attempts.
Industries
BankingThe voicemail-themed SVGs targeted healthcare, construction, and banking sectors, including administrative, financial, CEO, and finance contacts.ConstructionThe voicemail-themed SVGs targeted healthcare, construction, and banking sectors, including administrative, financial, CEO, and finance contacts.HealthcareThe voicemail-themed SVGs targeted healthcare, construction, and banking sectors, including administrative, financial, CEO, and finance contacts.