Most email filters treat SVG files as images. Attackers treat them as executable containers.

INKY tracked a phishing campaign that reached 5,527 organizations and generated 26,589 detected emails using SVG files to smuggle malicious JavaScript past standard defenses. The lure: a missed voicemail. The payload: credential-harvesting pages designed to capture Microsoft 365, Google Workspace, and Adobe login credentials plus MFA tokens.

The attack worked because the delivery vehicle looked passive. The file appeared safe until clicked.

Why This Matters Now

Email security tools have adapted to block executables, macro-enabled documents, and known malicious links. Attackers responded by shifting to file types that appear benign. SVG sits in that gap. It renders as an image in most contexts, but it can also execute JavaScript when opened in a browser.

This creates a perception mismatch. Employees see a file extension they associate with logos and graphics. Security filters often treat SVG as passive content, not a code delivery mechanism. That gap lets attackers deliver phishing infrastructure without triggering attachment-based blocks.

The campaign INKY observed used a simple social engineering hook: a notification about a missed voicemail. When the user clicked the SVG file, it opened a fake login page styled to match Microsoft 365, Google Workspace, or Adobe. Credentials entered on that page were sent to the attacker, along with any MFA tokens generated during the session.

This pattern is spreading because it exploits trust at two levels: trust in familiar file types and trust in login interfaces users recognize.

Three Strategic Gaps Exposed

Email Filters Treat SVG as Passive Content

Most email security platforms categorize SVG alongside JPEG or PNG. That classification assumes the file will only render visually. It does not account for embedded script tags or event handlers that execute when the file is opened.

• Filters miss the code layer hidden inside the image structure
• Attachment policies often exclude SVG from executable file categories
• Detection logic focused on macro documents and Office file exploits misses this vector entirely
• Sandboxing may render the image without triggering the JavaScript payload

Employees Expect Images to Be Safe

Users have been trained to distrust executables and scrutinize links. Image files carry no comparable warning signal. When an employee receives a voicemail notification with an attached image, the cognitive load is low. The file looks harmless.

• Security awareness training rarely covers file type abuse beyond macros and executables
• SVG files do not trigger the same suspicion as .exe or .zip attachments
• Visual similarity to legitimate image files creates a false sense of safety
• The shift from executable to image-based delivery bypasses user caution

Credential Pages Mimic Real Login Flows

The harvesting pages used in this campaign replicated Microsoft 365, Google Workspace, and Adobe login screens with high fidelity. They adapted branding based on the target's email domain. Some versions included adversary-in-the-middle (AiTM) proxies to capture session tokens, not just passwords.

• MFA does not stop attacks that intercept session tokens in real time
• Users conditioned to enter credentials on familiar-looking pages may not notice subtle URL discrepancies
• Attackers can automate credential reuse immediately after capture
• Token theft enables account access without triggering additional authentication challenges

The Strategic Shift Required

Stopping SVG-based phishing requires rethinking how email security evaluates file types. The current model assumes that non-executable files are low risk. That assumption no longer holds when image formats can contain code.

Organizations need detection logic that inspects file contents, not just extensions. SVG files should be scanned for embedded scripts, external references, and event handlers. Policies should treat any file capable of executing code as potentially hostile, regardless of how it renders.

User education must expand beyond traditional phishing indicators. Employees need to understand that file safety is not determined by visual appearance. Training should include examples of image-based code delivery and guidance on verifying login page authenticity before entering credentials.

• Update attachment policies to flag or block SVG files unless sender trust is established
• Deploy detection tools that parse SVG structure and identify embedded scripts
• Train users to recognize social engineering lures that use image files as delivery vehicles
• Implement session token protections and conditional access policies to limit credential theft impact

How Cloud Email Security for Microsoft 365 Addresses This

KnowBe4 Cloud Email Security adds a layer of phishing detection designed to catch file-based and social engineering threats that evade standard filters.

• Email Filters Treat SVG as Passive Content: The platform analyzes email attachments for malicious intent, including file types commonly treated as benign. Detection logic evaluates embedded code and suspicious structures inside image files.
• Employees Expect Images to Be Safe: By flagging phishing attempts that use trusted file types, the tool reduces reliance on user judgment. It intercepts threats before they reach inboxes, lowering the chance that employees will interact with malicious content.
• Credential Pages Mimic Real Login Flows: The platform identifies phishing infrastructure by analyzing email content, sender behavior, and linked destinations. It detects campaigns that use fake login pages and social engineering lures, even when delivery methods evolve.

Who This Is For

• Security engineers responsible for email threat detection and response
• IT managers overseeing Microsoft 365 or Google Workspace environments
• Email security administrators evaluating phishing defense gaps
• SOC analysts tracking credential theft campaigns and MFA bypass techniques

Call to Action

See how KnowBe4 Cloud Email Security detects file-based phishing your filters may miss. Visit https://knowbe4.optrics.com/cloud-email-security.html

FAQ

Why do attackers use SVG files instead of executables?
SVG files bypass attachment policies designed to block executables. They appear as images, which most users and filters treat as low risk. Embedded JavaScript allows attackers to deliver code without triggering traditional malware detection.

Can MFA stop credential theft from these phishing pages?
MFA reduces risk but does not eliminate it. Some phishing pages use adversary-in-the-middle techniques to capture session tokens during login. Once a token is stolen, attackers can access accounts without triggering additional authentication.

How can security teams detect SVG-based phishing?
Detection requires inspecting SVG file contents for embedded scripts and event handlers. Email security tools should parse file structure, not just evaluate extensions. Policies should flag or block SVG attachments unless sender trust is established.

What should employees do if they receive an unexpected voicemail notification?
Verify the notification through official channels before clicking attachments or links. Voicemail lures are common in phishing campaigns. If unsure, contact IT or use the phone system directly to check for messages.