As phishing tactics grow increasingly sophisticated, attackers are now leveraging overlooked file formats to bypass traditional security controls. One such method involves the use of Scalable Vector Graphics (SVG) files, which are commonly perceived as harmless image files but, in reality, can contain embedded malicious code.
At Wizard Cyber, we continuously monitor and respond to emerging threats across our client environments. This advisory explores how SVG files are exploited in phishing campaigns, the risks they present, and the defensive measures that organisations should implement to mitigate them.
What is SVG phishing?
SVG is an XML-based image format used to create scalable, high-resolution graphics. Unlike PNG or JPEG formats, SVG files can include embedded JavaScript, CSS, and HTML, enabling rich interactivity.
This capability makes SVG files a powerful tool for web development — but also a significant threat vector. Cybercriminals exploit SVGs by embedding malicious scripts or links within the file. When opened, often through a phishing email or malicious website, these scripts can:
- Redirect users to spoofed login portals
- Execute background JavaScript
- Harvest credentials or session information
- Load secondary payloads undetected
Because SVGs appear to be standard image files, users are unlikely to suspect malicious intent, and many security tools are not configured to scrutinise SVG content.
How do SVG phishing attacks work?
In a real sample we analysed, the payload was hidden inside a <script> tag within the SVG markup, split across two Base64-encoded variables.
The first variable, named canto, decoded to a target email address — in this case csi@wizardcyber.com, one of our own addresses. The second, named ways, decoded to a redirector URL of the form https://www.malicious.redirector?url=https://phishing.page/randomstring.
The JavaScript payload then redirected the user to the phishing page, appending their email address to the URL so the fake login form could be pre-populated and look convincing. Two things are happening at once: email address exfiltration, and redirection to a credential-harvesting page.
The techniques that make this work fall into four groups.
1. Embedded scripts. Attackers insert obfuscated JavaScript inside <script> tags within the SVG markup. When rendered in a browser or webmail client, this script can trigger a redirect or download additional malicious content.
2. Fake login interfaces. Some SVG files are designed to replicate familiar login forms, such as Microsoft 365 or Google Workspace. When users enter their credentials, the information is transmitted directly to the attacker.
3. Filter evasion. SVG files often bypass email security filters because they are treated as image files. Unlike PDFs or executable attachments, SVGs may not be flagged during standard filtering.
4. Obfuscation and multi-stage payloads. Threat actors encode scripts using Base64 or hexadecimal, or embed malicious code within CDATA or <foreignObject> tags. In some cases, SVGs are designed to appear legitimate by incorporating CAPTCHAs or branding elements.
Real-world trends and threat landscape
Our threat intelligence team has observed a marked increase in SVG phishing campaigns over the past 12 months. These campaigns frequently target:
- Financial services and fintech platforms
- Legal and consultancy firms
- Cloud collaboration environments
- Corporate email systems
SVG phishing emails often include lures such as:
- Fake voicemail alerts
- E-signature requests
- Invoice attachments
- Secure document previews
In many cases, attackers host SVG payloads on trusted domains such as cloud storage services, to bypass domain-based protections including SPF, DKIM and DMARC.
Recommendations
Defending against this vector needs a layered approach combining user awareness, technical controls and proactive monitoring.
1. Security awareness and training. Educate users that SVG files are not merely images but can contain executable code. Employees should be trained to treat unexpected or unsolicited SVG attachments with caution, particularly when received via email.
2. Email and attachment filtering. Implement advanced content inspection within email gateways to analyse SVG files for embedded scripts or abnormal structures. Where business use of SVG files is minimal, consider blocking SVG attachments altogether.
3. File sanitisation and CDR. Deploy solutions capable of sanitising SVG files by removing active content or converting them to secure formats such as PNG. Content Disarm and Reconstruction can neutralise embedded threats before files reach the user.
4. Secure client-side rendering. Disable JavaScript execution in SVG viewers and enforce Content Security Policies within browsers. Ensure document viewers and mail clients used across the organisation do not render dynamic SVG content unnecessarily.
5. Simulated attacks and incident response drills. Conduct regular phishing simulations that incorporate SVG-based payloads. This reinforces awareness, validates incident response readiness, and tests the efficacy of controls.
How Wizard Cyber helps
As a Microsoft Solutions Partner, Wizard Cyber delivers managed detection and response powered by threat intelligence and integrated with the Microsoft security stack.
Our services include:
- Proactive threat detection and incident response
- Advanced threat hunting and analysis
- Security operations centre management and orchestration
- Integration with Microsoft Sentinel for streamlined alert triage and investigation
Whether you are reviewing email security policies or seeking to audit your organisation’s exposure to advanced phishing techniques, we can assist with assessments and mitigation tailored to your environment.
Conclusion
SVG phishing is a clear example of how threat actors adapt to exploit technologies that are often overlooked. These files are increasingly used to bypass security filters, deceive users, and execute code without detection.
By understanding the risks associated with SVGs and implementing both technical and procedural defences, organisations can significantly reduce the likelihood of compromise.