Republished on July 19 with new analysis into this dangerous image email attack.
Here we go again. There’s a fast growing threat in your inbox that’s hard to detect — even for security software on your PC. This has “seemingly come out of nowhere,” but you need to be aware. And it means deleting a raft of incoming emails.
The new warning comes courtesy of Ontinue, which says “threat actors are increasingly leveraging Scalable Vector Graphics (SVG) files as a delivery vector for JavaScript-based redirect attacks.” Plenty of these images, “commonly treated as harmless” contain “embedded script elements” that lead to browser redirects. And that’s a huge risk.
While these images might be .SVG attachments, as we have seen before, they could also be links to external images pulled into the email. And the campaign also relies on spoofed domains and email lures to trick users into opening and engaging.
As Sophos explains, the SVG file format “is designed as a method to draw resizable, vector-based images on a computer. By default, SVG files open in the default browser on Windows computers. But SVG files are not just composed of binary data, like the more familiar JPEG, PNG, or BMP file formats. SVG files contain text instructions in an XML format for drawing their pictures in a browser window.”
VIPRE warns that “up until this point, SVGs have been recognized by email security tools as generally benign image files, which is why attackers are now having so much success hiding their nefarious exploits in them.”
Looking at these latest attacks, SlashNext’s J Stephen Kowski told me “when you open or preview these ‘images,’ they can secretly redirect your browser to dangerous websites without you knowing.” That means you need to be “extra careful” with images.
Because these attackers leverage spoofed domains and senders to trick you, it isn’t as easy as just avoiding emails from unknown senders. Instead, you should delete any email with an .SVG attachment unless you’re expecting it. And you should allow your browser to block external images until you’re certain of their origin.
Kowski says these emails will also likely be “pushy about viewing the image right away,” and while “your email provider’s built-in security features, such as spam filtering and safe attachments, can help, they’re not perfect against these newer tricks.”
Jason Soroko from Sectigo goes even further, warning security teams to “treat every inbound SVG as a potential executable,” as the surge in such attacks continues.
The real threat though lies in user complacency. SVG attacks, VIPRE says, are now tussling with PDFs to become “attackers’ favorite attachments of choice.” These are only images, most users assume, and so no click-throughs, no harm.
Bambenek Consulting’s John Bambenek says this is “a fresh spin on the technique of using image files for delivering suspect content, in this case, malicious PDFs. The attackers have to rely on complacency (“it’s only an image, it doesn’t execute code”) to lull organizations into accepting this content and getting it on the inside of a network.”
Ontinue says “the observed targets of this campaign fall into B2B Service Providers, including the ones handling valuable Corporate Data regularly, including Financial and Employee data, Utilities, Software-as-a-Service providers that are great social engineering targets as they expect to receive a high volume of emails.”
The payload itself “is delivered via an .SVG file that contains a JavaScript block hidden within a CDATA section. The embedded code uses a static XOR key to decrypt a secondary payload at runtime. This decoded script reconstructs and executes a redirect command using the Function() constructor.”
And the team warns “this technique demonstrates how adversaries are shifting away from executable payloads and towards smuggling (HTML and now SVG) techniques. By embedding script logic into image formats and using trusted browser functions, the attack chain avoids triggering traditional behavioral or signature-based alerts.”
The emails containing the attachments or links will be simple, “using a minimal format to avoid detection and provoke curiosity or interaction.” Hijacking poorly protected domains or spoofing others with special characters enhances the lure.
“While this report and research is valuable to enterprises,” Bambenek says, “and the search valuable for hunt teams, organizations without a security staff or end consumers will remain vulnerable to conventional cybercrime with this technique.”
“This SVG attack vector is exactly what we’ve been tracking,” Kowski warns. “Attackers have exhausted much of the text-based social engineering playbook over the last ten years and are now getting creative with content payloads to execute malicious code.” And this is easily done because “attackers can easily spoof trusted senders, making recipients more likely to open what appears to be an innocent image file.”
“The beauty of SVG files from an attacker’s perspective,” he told me, “is that they look like harmless images but can contain embedded JavaScript that runs the moment someone opens the file in a browser, bypassing traditional email security that focuses on executable attachments.” Which means users need a new defensive playbook.
And so the advice is just as simple. If you’re not expecting an email which includes image links or .SVG attachments, delete them from your inbox. “This campaign highlights a creative pivot in attacker methodology,” the team says, “using benign file formats to hide malicious logic and evade established detection controls.”
Which is another way of saying that you’re your own best defense.
