SVG files are offering cybercriminals an easy way in with new phishing attacks

SVG files could pose a security risk, experts warn. When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works. Hackers are using .SVG files in new phishing attacks aimed at stealing people’s Office 365 login credentials, experts have warned. A report from researchers at Sophos revealed the number of phishing attacks with .SVG files in attachments is on the rise. SVG (Scalable Vector Graphics) files are XML-based images that can be scaled without losing quality, making them ideal for web design, icons, and illustrations. Unlike raster images (e.g., PNG, JPG), SVGs use mathematical equations to define shapes, allowing them to remain crisp at any size.

Since SVG files are usually loaded natively inside a browser, they can contain anchor tags, scripts, and other kinds of active web content. Sophos notes the body of the phishing emails is nothing extraordinary. It’s the usual invoice/new voicemail/signature required type of email, with an .SVG attachment, that usually only displays a sentence or two, and a hyperlink. Sophos says that it’s seen these messages, especially the contents inside the SVG file, grow more sophisticated as the campaign progressed.

In any case, opening the SVG file brings up a new browser tab, and in it a hyperlink. Clicking the hyperlink redirects the victim to a fake Office365 login page that steals the login credentials and relays them to the attackers. There are two ways to defend against these phishing emails, Sophos said. The best way (aside from not clicking on shady email attachments) is to open a known, benign SVG file on the computer, and instruct Windows to always open it in Notepad, or a similar non-browser program.

“Even if you accidentally click a malicious SVG in the future, it’ll only open in Notepad, throwing another roadblock in front of (potentially) being phished,” Sophos explained. “If, at some point, you find you need to work with real SVG files, follow the same steps again, and choose the graphics application you plan to use.”. Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!.

The second way is to use a reputable email security program. Sophos said a detection signature was developed for the various kinds of weaponized files it recently observed. Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.