HTML smugglers turn to SVG images
Summary: Cisco Talos reports attackers using a newer HTML smuggling technique in which malicious emails carry HTML attachments with base64-encoded SVG images that contain HTML script tags, a legitimate SVG feature being abused to run JavaScript on the victim's machine. In the Qakbot campaign shown, that JavaScript assembles an encrypted zip archive locally on the device, prompts the user to save it with a supplied password, and the extracted .iso file is intended to infect the victim with Qakbot, per Cisco Secure Malware Analytics.
Bottom line: Because the payload is built on the victim's machine rather than transmitted over the network, this technique can bypass security devices that filter malicious content in transit - and the hijacked email thread shown here dates to 2020, so an old, familiar conversation is no guarantee of safety.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026