Kaspersky has detected a new trend with attackers distributing phishing emails to individual and corporate users with attachments in SVG (Scalable Vector Graphics) files – a format commonly used for storing images. Opening these files leads a user to phishing pages mimicking Google and Microsoft services aiming to steal login credentials. There was an almost six-fold increase in phishing via SVG files in March 2025 compared to February, and over 4,000 of these emails have been detected globally since the beginning of the year.
SVG is a format for describing two-dimensional vector graphics using XML, a markup language that provides rules to define any data. SVG supports JavaScript and HTML, unlike JPEG or PNG image format. This makes it easier for designers to work with non-graphical content like text, formulas and interactive elements. However, attackers are exploiting this by embedding scripts with links to phishing pages within the image file. Users might open these files out of curiosity, thinking they are images.
The attached SVG file is essentially an HTML page with no description of graphics. When opened in a web browser, this file appears as a web page with a link that supposedly points to an audio file. Clicking on this redirects the user to a phishing page mimicking a Google Voice audio recording with the audio track actually being a static image. Clicking “Play Audio” further redirects the user to a corporate email login page, allowing attackers to capture their credentials. This page, too, mentions Google Voice. The page also includes the target company’s logo, aiming to lower the user’s guard.
In a separate instance, mimicking a notification from an e-signature service, attackers presented an SVG attachment as a document that required review and signature.
Unlike the first example, where the SVG file acted as an HTML page, in this case it contains JavaScript that, when the file is opened, launches a browser window with another fake login phishing site, this time mimicking Microsoft.
“Phishers are relentlessly exploring new techniques to circumvent detection. They vary their tactics, sometimes employing user redirection to confuse, and other times, experimenting with different attachment formats. Attacks with SVG attachments are showing a clear upward trend. While currently these attacks are relatively basic, with SVG files containing either a phishing link page or a redirection script to a fraudulent site, the use of SVG as a container for malicious content can also be employed in more sophisticated targeted attacks,” comments Roman Dedenok, Anti-Spam Expert at Kaspersky.
In order to avoid becoming a victim of phishing or malicious messages, Kaspersky experts advise the following:
- Only open emails and click links if you are sure you can trust the sender.
- When a sender is legitimate, but the content of the message seems strange, it is worth checking with the sender via an alternative means of communication.
- Check the spelling of a website’s URL if you suspect you are faced with a phishing page. The URL may contain mistakes that are hard to spot at first glance, such as a 1 instead of I or 0 instead of O.
