SVG attachments used in widespread phishing campaign

Based on information from Infosecurity Magazine, a recent phishing campaign utilized scalable vector graphics (SVG) attachments disguised as voicemail files to bypass email defenses. The campaign, which ran from June 1 to August 4, 2026, sent approximately 26,589 messages to over 5,500 organizations, according to email security vendor INKY, which is part of Kaseya.

The attackers employed a broad, non-targeted approach, sending messages in waves and largely avoiding weekends. The SVG attachments were designed to appear as voicemail notifications, often using the recipient's email address in the subject line. Crucially, these attachments declared a text/plain MIME type instead of the expected image/svg+xml, allowing them to evade initial scanning. Inside the SVG files, obfuscated JavaScript was hidden within a minimal graphic shell. This script reconstructed strings at runtime, fetched a remote endpoint, and used techniques like deferred execution and runtime script injection to evade detection.

Native spam filters largely missed the malicious emails, with 75% receiving a low spam confidence level. The campaign's success relied on combining a familiar voicemail pretext, an image format, personalization, and internal sender impersonation, with the SVG attachment serving as the conduit for executable browser content.

Source: Infosecurity Magazine