Extensive Phishing Campaign Unveiled: SVG Attachments Misused to Compromise Security
In a notable two-month-long phishing campaign, cybercriminals employed the deceptive tactic of using Scalable Vector Graphics (SVG) attachments disguised as voicemail notifications to circumvent email security measures. This campaign, which has been identified as affecting 5,527 organizations, led to the detection of an alarming total of 26,589 phishing messages.
Detection by Security Experts
The email security firm INKY, which operates under the umbrella of Kaseya, played a crucial role in uncovering this malicious operation. In a detailed technical report released on August 27, 2026, INKY outlined how the phishing campaign unfolded in waves from June 1 to August 4, 2026, with activity typically subsiding over weekends. Remarkably, INKY recorded its highest volume of detected messages on June 3, when it flagged an astonishing 2,432 emails that reached 1,149 different organizations. Intriguingly, the campaign was still active when INKY completed its analysis, indicating its persistent nature.
Lack of Precision Targeting
The data retrieved from this campaign demonstrates a distinct lack of precision targeting. On average, the median organization received only two phishing emails, with a significant 32% of targeted institutions encountering just a single message. Notably, the ten entities most impacted accounted for a mere 6% of the total phishing attempts, aligning with a more generalized delivery method rather than a concentrated spear-phishing approach.
SVG Smuggling Technique
The ingenuity of this campaign lies in its use of SVG files, which served as a sophisticated method to embed malicious JavaScript within seemingly innocuous email attachments. These deceptive emails were typically framed as internal voicemail notifications, with an astonishing 99.5% of the message subjects containing localized elements of the recipient’s actual email address. The attachments were labeled with voicemail-style names and contained SVG and XML content, cleverly masked to evade detection.
A significant aspect of this subterfuge was the MIME type of the attachments. By indicating a MIME type of text/plain instead of the expected image/svg+xml, the phishing emails tricked basic scanning mechanisms into interpreting the files as harmless text documents. This crucial distinction is pivotal because SVG files inherently possess the capacity to harbor executable JavaScript.
Obfuscation and Evasion Tactics
INKY’s analysis of the samples revealed that the minimal graphical elements concealed complex obfuscation techniques within the script, allowing it to reconstruct strings at runtime and interact with remote endpoints. The malicious code utilized deferred execution and runtime script injection, rendering its activities challenging to detect through conventional static inspection methods.
INKY’s findings underscore the sophisticated nature of this phishing operation, which effectively combined social engineering tactics with technical evasion strategies. The utilization of SVG attachments effectively served as a bridge linking deceptive messaging and executable browser content.
Inadequate Native Spam Filtering
One of the more alarming revelations from this campaign is the inadequacy of native spam filters in identifying the malicious messages. INKY reported that 95% of the phishing emails claimed to originate from the recipient’s own domain, while in actuality, they were dispatched from external senders lacking proper authentication to the organizations’ mail servers.
The inherent flaws in native spam scoring systems became particularly evident, as approximately 19,994 messages (about 75%) received a Microsoft Spam Confidence Level (SCL) of 0 or 1, categorizing them as non-spam. Conversely, only 4,777 messages (approximately 18%) received a higher SCL rating of 5, indicating potential spam. Intriguingly, despite being constructed from a single template, the same phishing message elicited various spam detection verdicts depending on the recipient’s mailbox settings.
Conclusion
The findings from INKY’s investigation into this phishing campaign illuminate the multifaceted approach employed by cybercriminals, merging various elements of social engineering, technical evasion, and impersonation to compromise email defenses. The SVG attachment method demonstrates a disturbing innovation in phishing tactics, posing significant challenges for existing security measures. This situation serves as a stark reminder of the necessity for organizations to bolster their email security protocols to mitigate the risks inherent in sophisticated phishing schemes that continue to evolve.