Full Report
SVGs are difficult to detect, can be snuck into content — and can do malicious and legitimate actions. Here's how malicious SVGs work.
Analysis Summary
# Tool/Technique: Malicious Scalable Vector Graphics (SVG)
## Overview
Scalable Vector Graphics (SVG) are XML-based image files that support interactivity and animation through embedded scripts. While primarily used for legitimate web design, threat actors weaponize the SVG format to bypass traditional security filters that often treat images as benign. By embedding JavaScript within the XML structure, attackers can execute code directly in a user’s browser to facilitate phishing, malware delivery, or data theft.
## Technical Details
- **Type**: Technique (Abuse of legitimate file format)
- **Platform**: Cross-platform (Web browsers, Email clients, OS file explorers)
- **Capabilities**: Script execution (JavaScript), HTML/CSS rendering, automatic redirection, DOM manipulation.
- **First Seen**: Format proposed in 1994; uptick in malicious utilization noted significantly in early 2026.
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1566 - Phishing (Malicious attachments or links to SVGs)
- **TA0002 - Execution**
- T1204.002 - User Execution: Malicious File
- **TA0005 - Defense Evasion**
- T1027 - Obfuscated Files or Information (Embedding scripts in image tags)
- T1213 - Data from Information Repositories (DOM Clobbering)
- **TA0007 - Discovery**
- T1082 - System Information Discovery (via browser fingerprinting scripts)
## Functionality
### Core Capabilities
- **Redirectors**: Using simple JavaScript (e.g., `window.location`) to automatically send users from a "benign" image to a malicious URL or credential harvesting site.
- **Self-Contained Phishing**: Leveraging SVG’s ability to render HTML and CSS to display pixel-perfect login forms (e.g., Microsoft 365 or Google login prompts) entirely within the image file.
- **Malware Downloader**: Acting as a dropper by using scripts to fetch and execute secondary payloads once the image is opened.
### Advanced Features
- **DOM Clobbering/Injection**: Manipulating the Document Object Model (DOM) of a host page to achieve Cross-Site Scripting (XSS) effects.
- **Stealth**: SVGs maintain searchable text and XML structures that can be easily obfuscated to hide malicious strings from basic keyword scanners.
- **Default Execution**: Most modern browsers execute embedded SVG JavaScript by default when the file is opened directly.
## Indicators of Compromise
- **File Hashes**: *Note: Hashes vary significantly due to the polymorphic nature of XML/SVG.*
- **File Names**: Often mimic legitimate documents (e.g., `invoice.svg`, `repayment_details.svg`, `company_logo.svg`).
- **Network Indicators**:
- Redirections to suspicious domains (e.g., `hxxp[:]//malicious-phish[.]com/login`)
- External script sourcing within the `<script>` tag of the SVG.
- **Behavioral Indicators**:
- Browser process (`chrome.exe`, `firefox.exe`) initiating unexpected file downloads after opening an image.
- Outbound network requests to known phishing infrastructures triggered by an image view.
## Associated Threat Actors
- **ClickFix (MaaS)**: Identified as a primary campaign vector utilizing social engineering and malicious scripts.
- **MaaS Groups**: Various Malware-as-a-Service operators (e.g., Aurastealer, ACRStealer) often use SVGs as initial delivery vectors.
## Detection Methods
- **Signature-based detection**: Scanning for `<script>` tags, `onmouseover` events, or `<iframe>` tags within files ending in `.svg`.
- **Behavioral detection**: Monitoring for browser-based redirections or credential-entry behaviors originating from local file paths (e.g., `file:///.../*.svg`).
- **YARA rules**: Rules designed to flag SVG files containing common JavaScript obfuscation patterns or specific phishing keywords (e.g., "password", "login").
## Mitigation Strategies
- **Prevention**: Configure email gateways to block or sanitize SVG attachments.
- **Hardening**: Implement Content Security Policy (CSP) headers that restrict the execution of inline scripts and prevent unauthorized redirects.
- **User Awareness**: Educate users that images (SVGs) can be interactive and malicious, just like .EXE or .DOCX files.
- **Tooling**: Use advanced file analysis platforms (like Spectra Assure) that inspect the internal composition of files rather than relying solely on extension or reputation.
## Related Tools/Techniques
- **HTML Smuggling**: Using HTML5 features to "smuggle" a malicious payload.
- **XSS (Cross-Site Scripting)**: The underlying vulnerability type often exploited by malicious SVGs.
- **Steganography**: While SVGs use overt scripts, they share the goal of hiding malicious intent within image data.