Seemingly harmless SVGs are packed with malicious JavaScript for a phishing redirect to actor-controlled URLs.

Once opened in a browser, the code decrypts a secondary payload using a static XOR key and then redirects the user to an ...

The malicious code is hidden within a CDATA section of the SVG file and relies on a static XOR key to decrypt a payload at runtime. The decrypted code reconstructs a redirect command and builds a ...

Threat actors increasingly use Scalable Vector Graphics (SVG) attachments to display phishing forms or deploy malware while evading detection. Most images on the web are JPG or PNG files, which ...