Tuesday, May 6, 2025
Homecyber securityBeware of Encrypted Phishing Attack With Weaponized SVG Files

Beware of Encrypted Phishing Attack With Weaponized SVG Files

Published on

SIEM as a Service

Follow Us on Google News

Attackers are now leveraging encrypted phishing emails that utilize Scalable Vector Graphics (SVG) files to execute malicious JavaScript code.

The phishing campaign begins with an email masquerading as a notification for a new voice message.

Recipients are prompted to click on a link to access this message, a classic attraction that plays on human curiosity and the urgency of communication.

- Advertisement - Google News

Upon clicking the link, the target is taken to a page loaded with heavily obfuscated HTML data.

This is where the attackers’ creativity comes into play. They embed JavaScript code within an SVG image that is executed once the page is rendered on the victim’s system.

Document
Stop Advanced Phishing Attack With AI

AI-Powered Protection for Business Email Security

Trustifi’s Advanced threat protection prevents the widest spectrum of sophisticated attacks before they reach a user’s mailbox. Stopping 99% of phishing attacks missed by other email security solutions. .

This new tactic, uncovered by ARC Labs, a division of Binary Defense, marks a concerning evolution in phishing campaigns, aiming to harvest credentials by tricking targets with seemingly innocuous voice message notifications.

SVG: A Vector for Attack

SVG files, commonly used for their scalability and quality in web graphics, are now being weaponized to execute JavaScript.

This method is particularly insidious as it bypasses traditional security measures that may not scrutinize image files for malicious code.

Illustration of JavaScript execution from an SVG file.
Illustration of JavaScript execution from an SVG file.

Encrypted Data and the Second Stage

Within the SVG, ARC Labs discovered encrypted data that, when decrypted, revealed a second stage in the phishing attack.

This stage prompts the victim to enter their credentials to access the voice message.

The decryption of this data is facilitated by CryptoJS, a library that allows for the encryption and decryption of data within JavaScript.

The complexity of this attack lies in the encryption of the second-stage page data across multiple HTML classes, which is dynamically decrypted using CryptoJS.

This approach not only conceals the malicious intent but also complicates the analysis and detection of the phishing attempt.

ARC Labs’ analysis of the JavaScript code during runtime was crucial in uncovering the mechanics of this attack.

By setting breakpoints at every invocation of CryptoJS, researchers recovered the decryption key, a critical step in decrypting the content and understanding the full scope of the phishing attempt.

The process of decrypting the encrypted data using CryptoJS.offer
The process of decrypting the encrypted data using CryptoJS.offer

This case study is a stark reminder of the evolving landscape of cyber threats and the innovative methods attackers employ to compromise personal information.

Users are urged to exercise caution when emails prompt action, especially those that lead to external pages requesting credential input.

For organizations, the importance of comprehensive security measures, including the analysis and understanding of emerging threats, cannot be overstated.

As attackers refine their techniques, staying informed and vigilant is the best defense against these encrypted phishing attacks.

The weaponization of SVG files in phishing campaigns represents a significant shift in the tactics used by cybercriminals.

Attracting malicious JavaScript code from encrypted data in SVG images, attackers find new ways to bypass security measures and exploit human vulnerabilities.

The analysis conducted by ARC Labs illuminates this sophisticated attack method, offering valuable insights into its mechanics and emphasizing the need for heightened awareness and security practices.

Secure your emails in a heartbeat! To find your ideal email security vendor, Take a Free 30-Second Assessment.

Divya
Divya
Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Latest articles

Ransomware Attacks on Food & Agriculture Industry Surge 100% – 84 Attacks in Just 3 Months

The food and agriculture industry is facing an unprecedented wave of cybersecurity threats in...

Microsoft 365 Copilot and Office Apps Now Protected by SafeLinks at Click Time

Microsoft announced a major update aimed at bolstering the cybersecurity of its flagship AI-powered...

Hackers Targeting Schools and Universities in New Mexico with Cyber Attacks

A major cyberattack on the Coweta County School System's computer network occurred late Friday night, which is a worrying development for New Mexico's educational institutions. The unauthorized intrusion, detected around 7:00 p.m., prompted immediate action from the school...

Initial Access Brokers Play a Vital Role in Modern Ransomware Attacks

The ransomware threat landscape has evolved dramatically in recent years, with specialized cybercriminals like...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Ransomware Attacks on Food & Agriculture Industry Surge 100% – 84 Attacks in Just 3 Months

The food and agriculture industry is facing an unprecedented wave of cybersecurity threats in...

Microsoft 365 Copilot and Office Apps Now Protected by SafeLinks at Click Time

Microsoft announced a major update aimed at bolstering the cybersecurity of its flagship AI-powered...

Hackers Targeting Schools and Universities in New Mexico with Cyber Attacks

A major cyberattack on the Coweta County School System's computer network occurred late Friday night, which is a worrying development for New Mexico's educational institutions. The unauthorized intrusion, detected around 7:00 p.m., prompted immediate action from the school...