Security researchers are tracking a notable increase in phishing campaigns that cleverly weaponize Scalable Vector Graphics (SVG) image files to deliver malicious payloads and steal credentials.
A consensus is forming among security firms, including Kaspersky, Trustwave, and Sophos, indicating a dramatic rise in these attacks starting late 2024 and accelerating through the first quarter of 2025. This trend highlights a tactical shift by attackers aiming to circumvent traditional email security measures.
Kaspersky alone detected over 2,825 emails using this method between January and March 2025, with the volume continuing to climb into April. Independent findings corroborate this; KnowBe4 saw a 245% jump in malicious SVG use between Q4 2024 and early March 2025, while Trustwave reported an 1800% surge in early 2025 compared to previous levels.
How SVG Files Become Weapons
The technique’s effectiveness hinges on the fundamental nature of SVG files. Unlike standard raster image formats such as JPEG or PNG which primarily store pixel data, SVGs are XML-based documents. This text-based structure, designed for defining vector shapes and paths, crucially allows them to contain embedded scripts and other content, including JavaScript and full HTML documents (often implemented using the <foreignObject> tag). This capability, intended for legitimate web design and interactivity, is being actively misused.
Attackers craft malicious SVG files, frequently disguising them within emails as harmless documents needing signatures, voicemail notifications, or even spreadsheets. When a victim opens the attached SVG file – typically handled by the web browser which interprets the XML and any embedded scripts – the malicious code executes. The SVGfiles often achieve low detection rates on security scanning platforms, making them an attractive vector for attackers.
Attack Methods and Examples
Attackers have demonstrated two main approaches. In some campaigns, like one mimicking Google Voice detailed by Kaspersky, the SVG file itself contains the complete HTML code for a phishing page, rendering a fake interface directly in the browser upon opening. Other attacks, observed by Kaspersky, embed JavaScript within the SVG.
This script executes when the file is opened, automatically redirecting the user’s browser to an external, attacker-controlled phishing site, frequently a counterfeit Microsoft login page. One such Adversary-in-the-Middle (AITM) campaign was documented in February 2025 where the SVG initially displayed only a blue checkmark image before redirecting through fake security prompts to a credential harvesting page personalized with the target company’s branding.
AITM techniques involve the attacker positioning themselves between the user and the legitimate service, aiming to intercept credentials or session cookies even when multi-factor authentication is present.
Evasion Tactics and Attacker Infrastructure
The use of SVG files presents several advantages for attackers seeking to evade detection. Because the file’s technical MIME type is image/svg+xml, it can bypass email gateways and security filters primarily configured to scrutinize more traditionally risky attachment types like executables or certain document formats.
SVGs are often overlooked by such filters, posing a challenge to conventional defenses. Attackers further enhance evasion using techniques like polymorphic (randomized) filenames and sending emails from previously compromised legitimate accounts to pass sender authentication checks like DMARC, SPF, and DKIM (standards designed to prevent email spoofing). Obfuscation methods like Base64 encoding for embedded scripts (a way to represent binary data in an ASCII string format) and dynamically fetching elements like company logos to enhance the phish’s authenticity are also employed.
The surge in SVG phishing is also linked to the proliferation of Phishing-as-a-Service (PhaaS) platforms specializing in AITM attacks. These platforms offer ready-made kits that simplify the process of launching sophisticated phishing campaigns.
Trustwave SpiderLabs connects the rise to kits like Tycoon2FA, Mamba2FA, and Sneaky2FA, which provide attackers with the tools to deploy these sophisticated campaigns, including the use of SVG attachments for the initial redirection. This readily available infrastructure lowers the barrier to entry for conducting complex phishing operations.
A Growing Threat in a Vulnerable Environment
This SVG technique represents the latest adaptation in the ongoing battle between attackers and defenders, arriving amidst a generally worsening phishing environment. Analysis from Netskope about 2024 showed that enterprise users became three times more likely to click phishing links compared to 2023, jumping from 2.9 to 8.4 clicks per 1,000 users each month.
Netskope’s report attributed this vulnerability partly to “cognitive fatigue (with users constantly being bombarded with phishing attempts)” alongside “the creativity and adaptability of the attackers in delivering harder-to-detect baits.” The report also highlighted the use of generative AI tools like WormGPT and FraudGPT by attackers to create more convincing lures.
While SVG phishing is a relatively new trend in terms of widespread use, the exploitation of SVG script capabilities isn’t entirely novel; Cisco Talos documented Qakbot malware campaigns in 2022 using SVGs embedded within HTML attachments for payload smuggling via a technique known as HTML smuggling.
The current wave, however, focuses directly on credential theft, often targeting popular cloud services. Microsoft 365 was the top target in Netskope’s 2024 data (42%), followed by Adobe Document Cloud (18%) and DocuSign (15%), aligning with the types of fake login pages seen in recent SVG campaigns.
Kaspersky researchers caution that while current SVG attacks are often functionally similar to basic HTML attachment phishing, “the use of SVG as a container for malicious content can also be employed in more sophisticated targeted attacks.” The abuse of trusted platforms like Cloudflare for hosting phishing infrastructure, as reported previously based on Fortra findings, also remains a related concern. Zachary Travis of Fortra noted, “These platforms are not only being used to host convincing phishing sites, but also redirect to other malicious sites.”
