Exploiting SVG Files – How Threat Actors Are Using Them to Deliver Malicious JavaScript

Cybersecurity researchers have uncovered a sophisticated new attack campaign where threat actors are weaponizing Scalable Vector Graphics (SVG) files to deliver malicious JavaScript payloads and redirect unsuspecting users to attacker-controlled infrastructure.

This emerging technique exploits the trusted nature of image files to bypass traditional security controls and execute client-side attacks without requiring file downloads or user interaction.

Technical Sophistication Behind SVG Attacks

The attack methodology centers on embedding obfuscated JavaScript within SVG files using <script><![CDATA[...]]></script> sections.

Attackers use static XOR keys to encrypt secondary payloads, which are decrypted at runtime in the victim’s browser.

The malicious code reconstructs and executes redirect commands using the Function() constructor, with destination URLs built using atob() functions.

A typical payload includes Base64-encoded tracking strings appended to the final redirect URL, enabling victim correlation and campaign tracking.

The JavaScript execution occurs silently when the SVG file is rendered in a browser, leveraging trusted browser functions like window.location.href to perform redirects without triggering traditional behavioral or signature-based security alerts.

The campaign utilizes email spoofing and impersonation tactics, targeting organizations with weak email authentication policies.

Researchers noted that victims consistently lack DKIM records and have DMARC quarantine policies disabled, with some missing DMARC records entirely.

Attackers exploit these vulnerabilities by using lookalike domains that closely resemble legitimate entities.

Targeting Business Services and Critical Infrastructure

The campaign primarily targets B2B service providers that handle valuable corporate data, including financial services, utilities, and Software-as-a-Service (SaaS) providers.

These organizations represent attractive targets due to their high volume of regular emails and access to sensitive employee and financial information.

Phishing themes vary across “ToDoList,” “Missed Call,” and “Payment” topics, with minimal email content designed to reduce suspicion while provoking curiosity.

The attackers have enhanced their infrastructure with geofencing capabilities on landing sites, adding another layer of targeting precision.

Defending Against SVG-Based Attacks

Security experts recommend implementing comprehensive email hardening measures, including enforcement-mode DMARC policies with SPF/DKIM alignment.

Organizations should consider blocking SVG attachments or implementing content disarmament and reconstruction (CDR) solutions for inbound email processing.

Microsoft Defender for Office 365 users should enable Safe Links and Safe Attachments, configure anti-phishing policies, and activate Zero-hour Auto Purge for post-delivery threat detection.

Deep content inspection tools should flag SVG files containing script logic and encoding routines.

The Continue Threat Detection team has released detection queries to identify suspicious SVG files in enterprise environments, focusing on correlating email delivery with browser process execution patterns.

This campaign represents a significant evolution in attack methodology, demonstrating how adversaries adapt by exploiting trusted file formats to evade established security controls.