SVG Files: A New Gateway for Cybercriminal Phishing Attacks

Recent findings from Sophos indicate a significant surge in the use of .SVG files as a medium for phishing attacks targeting users’ Office 365 credentials. SVG, or Scalable Vector Graphics, is an XML-based image format that allows graphics to be scaled without losing clarity. This versatility, while beneficial for web designers and illustrators, has also made SVGs a prime choice for cybercriminals seeking to exploit unsuspecting individuals.

Table of Contents

1. The Rising Use of SVG in Phishing Attacks
2. How SVG Files Work in Phishing
3. Protecting Against SVG-Based Phishing

The Rising Use of SVG in Phishing Attacks

The exploitation of SVG files in phishing attempts is gaining traction as it enables hackers to bypass conventional email protection mechanisms. Unlike standard image formats such as JPG or PNG, SVGs can contain interactive elements like anchor tags and scripts, which are rendered natively in a web browser. This characteristic allows cybercriminals to create seemingly innocent emails that mask their true intentions.

Sophos points out that these phishing emails typically resemble legitimate communications. They often include familiar contexts, such as:

• Invoices: Fake billing statements that prompt immediate action.
• Voice Messages: Notifications suggesting there’s a new voicemail to review.
• Signature Requests: Emails requesting the user to verify their signature.

Within these messages lies the malicious .SVG attachment, which may only display a few lines of text and an embedded hyperlink. As these phishing campaigns evolve, the content within the SVG files has become increasingly sophisticated and convincing.

How SVG Files Work in Phishing

Upon opening an SVG file from a phishing email, the user unwittingly opens a new browser tab. The SVG file’s design often contains a hyperlink that directs the victim to a counterfeit Office365 login page. This page is a mirror of the legitimate site, tricking users into entering their login credentials.

When the user inputs their information, it is sent directly to the attackers, who can then misuse these credentials at will. Given the ever-evolving nature of digital threats, such tactics underline the need for heightened vigilance among potential victims.

Protecting Against SVG-Based Phishing

In light of these growing threats, Sophos has outlined effective strategies for defending against these SVG attacks:

• Avoid Clicking: Always refrain from clicking on unknown or suspicious email attachments.
• Open SVG Files Safely: If you find it necessary to open an SVG file, configure your computer to open it in a non-browser application, such as Notepad. This action will prevent any embedded links or scripts from executing. You can do this by:
1. Right-clicking on an SVG file.
2. Selecting “Open with.”
3. Choosing a text editor like Notepad and setting it as the default application for SVG files.
• Utilize Email Security Software: Employ reputable email security programs that can detect and block malicious file types. Sophos has already developed a detection signature for the various variants of weaponized SVG files.

By implementing these measures, users can significantly diminish the risk of falling victim to such phishing schemes. Even experienced users should be cautious, as these methods can easily catch anyone off guard.

You might also like

• Hackers are loading SVG files with multi-stage malware in new phishing attack
• We’ve rounded up the best password managers
• Take a look at our guide to the best authenticator app