Ankura CTIX FLASH Update - November 19, 2024

Malware Activity

SVG Attachments Increasingly Popular in Phishing Attacks

Cybersecurity researchers have found that Scalable Vector Graphics (SVG) attachments are becoming an increasingly popular way for threat actors to deliver malware or send phishing forms while evading detection. SVG files display images via code instead of using pixels, allowing the vector images to automatically resize without losing quality in different resolutions. SVG files have been used before by threat actors, notably to distribute Qbot malware via HTML smuggling. In recent campaigns, researchers have observed SVG files that display HTML and execute JavaScript, crafted to display phishing forms which can send victims' inputs back to the attacker. SVG attachments can also embed links that when clicked lead to a malware site or use JavaScript to automatically redirect browsers to malicious sites. Due to the nature of SVG files, they can more easily evade detection from security