Sunday, May 19, 2024

Beware of Encrypted Phishing Attack With Weaponized SVG Files

Attackers are now leveraging encrypted phishing emails that utilize Scalable Vector Graphics (SVG) files to execute malicious JavaScript code.

The phishing campaign begins with an email masquerading as a notification for a new voice message.

Recipients are prompted to click on a link to access this message, a classic attraction that plays on human curiosity and the urgency of communication.

Upon clicking the link, the target is taken to a page loaded with heavily obfuscated HTML data.

This is where the attackers’ creativity comes into play. They embed JavaScript code within an SVG image that is executed once the page is rendered on the victim’s system.

Stop Advanced Phishing Attack With AI

AI-Powered Protection for Business Email Security

Trustifi’s Advanced threat protection prevents the widest spectrum of sophisticated attacks before they reach a user’s mailbox. Stopping 99% of phishing attacks missed by other email security solutions. .

This new tactic, uncovered by ARC Labs, a division of Binary Defense, marks a concerning evolution in phishing campaigns, aiming to harvest credentials by tricking targets with seemingly innocuous voice message notifications.

SVG: A Vector for Attack

SVG files, commonly used for their scalability and quality in web graphics, are now being weaponized to execute JavaScript.

This method is particularly insidious as it bypasses traditional security measures that may not scrutinize image files for malicious code.

Illustration of JavaScript execution from an SVG file.
Illustration of JavaScript execution from an SVG file.

Encrypted Data and the Second Stage

Within the SVG, ARC Labs discovered encrypted data that, when decrypted, revealed a second stage in the phishing attack.

This stage prompts the victim to enter their credentials to access the voice message.

The decryption of this data is facilitated by CryptoJS, a library that allows for the encryption and decryption of data within JavaScript.

The complexity of this attack lies in the encryption of the second-stage page data across multiple HTML classes, which is dynamically decrypted using CryptoJS.

This approach not only conceals the malicious intent but also complicates the analysis and detection of the phishing attempt.

ARC Labs’ analysis of the JavaScript code during runtime was crucial in uncovering the mechanics of this attack.

By setting breakpoints at every invocation of CryptoJS, researchers recovered the decryption key, a critical step in decrypting the content and understanding the full scope of the phishing attempt.

The process of decrypting the encrypted data using CryptoJS.offer
The process of decrypting the encrypted data using CryptoJS.offer

This case study is a stark reminder of the evolving landscape of cyber threats and the innovative methods attackers employ to compromise personal information.

Users are urged to exercise caution when emails prompt action, especially those that lead to external pages requesting credential input.

For organizations, the importance of comprehensive security measures, including the analysis and understanding of emerging threats, cannot be overstated.

As attackers refine their techniques, staying informed and vigilant is the best defense against these encrypted phishing attacks.

The weaponization of SVG files in phishing campaigns represents a significant shift in the tactics used by cybercriminals.

Attracting malicious JavaScript code from encrypted data in SVG images, attackers find new ways to bypass security measures and exploit human vulnerabilities.

The analysis conducted by ARC Labs illuminates this sophisticated attack method, offering valuable insights into its mechanics and emphasizing the need for heightened awareness and security practices.

Secure your emails in a heartbeat! To find your ideal email security vendor, Take a Free 30-Second Assessment.


Latest articles

Hackers Exploiting Docusign With Phishing Attack To Steal Credentials

Hackers prefer phishing as it exploits human vulnerabilities rather than technical flaws which make...

Norway Recommends Replacing SSLVPN/WebVPN to Stop Cyber Attacks

A very important message from the Norwegian National Cyber Security Centre (NCSC) says that...

New Linux Backdoor Attacking Linux Users Via Installation Packages

Linux is widely used in numerous servers, cloud infrastructure, and Internet of Things devices,...

ViperSoftX Malware Uses Deep Learning Model To Execute Commands

ViperSoftX malware, known for stealing cryptocurrency information, now leverages Tesseract, an open-source OCR engine,...

Santander Data Breach: Hackers Accessed Company Database

Santander has confirmed that there was a major data breach that affected its workers...

U.S. Govt Announces Rewards up to $5 Million for North Korean IT Workers

The U.S. government has offered a prize of up to $5 million for information...

Russian APT Hackers Attacking Critical Infrastructure

Russia leverages a mix of state-backed Advanced Persistent Threat (APT) groups and financially motivated...
Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles