SVG files are offering cybercriminals an easy way in with new phishing attacks

A digital themed isometric showing a neon padlock in the foreground, and a technological diagram of a processor logic board in the background.
(Image credit: Shutterstock / JLStock)

  • Sophos says the use of SVG files in phishing is on the rise
  • SVG files bypass email protection and can display malicious hyperlinks
  • The researchers shared a few tips on how to stay safe

Hackers are using .SVG files in new phishing attacks aimed at stealing people’s Office 365 login credentials, experts have warned.

A report from researchers at Sophos revealed the number of phishing attacks with .SVG files in attachments is on the rise. SVG (Scalable Vector Graphics) files are XML-based images that can be scaled without losing quality, making them ideal for web design, icons, and illustrations. Unlike raster images (e.g., PNG, JPG), SVGs use mathematical equations to define shapes, allowing them to remain crisp at any size.

Since SVG files are usually loaded natively inside a browser, they can contain anchor tags, scripts, and other kinds of active web content.

Defending against SVG attacks

Sophos notes the body of the phishing emails is nothing extraordinary. It’s the usual invoice/new voicemail/signature required type of email, with an .SVG attachment, that usually only displays a sentence or two, and a hyperlink. Sophos says that it’s seen these messages, especially the contents inside the SVG file, grow more sophisticated as the campaign progressed.

In any case, opening the SVG file brings up a new browser tab, and in it a hyperlink. Clicking the hyperlink redirects the victim to a fake Office365 login page that steals the login credentials and relays them to the attackers.

There are two ways to defend against these phishing emails, Sophos said. The best way (aside from not clicking on shady email attachments) is to open a known, benign SVG file on the computer, and instruct Windows to always open it in Notepad, or a similar non-browser program.

“Even if you accidentally click a malicious SVG in the future, it’ll only open in Notepad, throwing another roadblock in front of (potentially) being phished,” Sophos explained. “If, at some point, you find you need to work with real SVG files, follow the same steps again, and choose the graphics application you plan to use.”

The second way is to use a reputable email security program. Sophos said a detection signature was developed for the various kinds of weaponized files it recently observed.

You might also like

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

You must confirm your public display name before commenting

Please logout and then login again, you will then be prompted to enter your display name.

Read more
Hacker Typing
This devious two-step phishing campaign uses Microsoft tools to bypass email security
An iPhone sitting on a wooden table
Millions at risk as malicious PDF files designed to steal your data are flooding SMS inboxes - how to stay safe
Close up of a business person using a smartphone.
Watch out, malicious PDF files are being used again in phishing attacks
email
Hidden text "salting" is letting hackers craft devious email attacks to evade detection
Close up of a person touching an email icon.
Criminals are using CSS to get around filters and track email usage
A fish hook is lying across a computer keyboard, representing a phishing attack on a computer system
Microsoft 365 accounts are under attack from new malware spoofing popular work apps
Latest in Security
Hacker silhouette working on a laptop with North Korean flag on the background
North Korea unveils new military unit targeting AI attacks
An image of network security icons for a network encircling a digital blue earth.
US government warns agencies to make sure their backups are safe from NAKIVO security issue
Laptop computer displaying logo of WordPress, a free and open-source content management system (CMS)
This top WordPress plugin could be hiding a worrying security flaw, so be on your guard
Computer Hacked, System Error, Virus, Cyber attack, Malware Concept. Danger Symbol
Veeam urges users to patch security issues which could allow backup hacks
UK Prime Minister Sir Kier Starmer
The UK releases timeline for migration to post-quantum cryptography
Representational image depecting cybersecurity protection
Cisco smart licensing system sees critical security flaws exploited
Latest in News
Quordle on a smartphone held in a hand
Quordle hints and answers for Sunday, March 23 (game #1154)
NYT Strands homescreen on a mobile phone screen, on a light blue background
NYT Strands hints and answers for Sunday, March 23 (game #385)
NYT Connections homescreen on a phone, on a purple background
NYT Connections hints and answers for Sunday, March 23 (game #651)
Google Pixel 9 Pro Fold main display opened
Apple is rumored to be prioritizing battery life on the foldable iPhone – which could also feature a liquid metal hinge for added durability
Google Pixel 9
The Google Pixel 10 just showed up in Android code – and may come with a useful speed boost
L-mount alliance
Sirui joins L-Mount Alliance to deliver its superb budget lenses for Leica, DJI, Sigma and Panasonic cameras