Novel AI-powered phishing campaign uncovered

U.S. organizations have mostly been targeted by a new phishing campaign that harnesses large language models to conceal nefarious payloads within Scalable Vector Graphics files, according to The Hacker News.

Hacked business email accounts have been tapped by attackers to deliver emails impersonating file-sharing notifications to lure targets into opening a PDF-spoofing SVG file, a report from the Microsoft Threat Intelligence team showed.

Opening the SVG file redirects to a fake CAPTCHA page that leads to a counterfeit login page that sought to pilfer credentials. Such an SVG file is believed to have been crafted using an LLM after analysis using Security Copilot revealed its code to be too complex and verbose, while lacking practical utility.

"While this campaign was limited in scope and effectively blocked, similar techniques are increasingly being leveraged by a range of threat actors," said Microsoft.

The findings follow a Forcepoint report detailing the spread of XWorm RAT in a phishing campaign involving .XLAM attachments.