Beware of Dangerous Emails with SVG Images - How to Stay Safe

Republished on July 19 with new analysis into this dangerous image email attack.

There’s a fast growing threat in your inbox that’s hard to detect — even for security software on your PC. Threat actors are increasingly leveraging Scalable Vector Graphics (SVG) files as a delivery vector for JavaScript-based redirect attacks. These seemingly harmless images contain embedded script elements that lead to browser redirects, posing a significant risk.

SVG files are designed to draw resizable, vector-based images on a computer. By default, SVG files open in the default browser on Windows computers. Attackers are hiding nefarious exploits in SVGs, taking advantage of the fact that email security tools often consider them benign image files.

When users open or preview these 'images,' they can unknowingly be redirected to dangerous websites. To stay safe, it is recommended to delete any email with an .SVG attachment unless you are expecting it. Additionally, consider allowing your browser to block external images until you can verify their origin.

Security experts warn that every inbound SVG should be treated as a potential executable. The surge in SVG attacks is making them a preferred choice for attackers, competing with PDFs as a delivery method for malicious content.

Attackers are targeting B2B Service Providers, including those handling valuable corporate data, with SVG-based attacks. The payload is delivered via an .SVG file containing a JavaScript block hidden within a CDATA section, demonstrating a shift towards smuggling techniques to avoid detection.

These attacks are designed to provoke curiosity and interaction, making them challenging to detect. Organizations without dedicated security staff remain vulnerable to such cyber threats.

If you receive an unexpected email with image links or .SVG attachments, it is advisable to delete them to protect yourself from potential threats. This campaign showcases attackers' use of benign file formats to conceal malicious logic and bypass detection controls.

According to the source: Forbes.