Delete Any Emails On Your Phone Or PC That Include These Images

Here we go again. There’s a fast growing threat in your inbox that’s hard to detect — even for security software on your PC. This has “seemingly come out of nowhere,” but you need to be aware. And it means deleting a raft of incoming emails.

The new warning comes courtesy of Ontinue, which says “threat actors are increasingly leveraging Scalable Vector Graphics (SVG) files as a delivery vector for JavaScript-based redirect attacks.” Plenty of these images, “commonly treated as harmless” contain “embedded script elements” that lead to browser redirects. And that’s a huge risk.

While these images might be .SVG attachments, as we have seen before, they could also be links to external images pulled into the email. And the campaign also relies on spoofed domains and email lures to trick users into opening and engaging.

VIPRE warns that “up until this point, SVGs have been recognized by email security tools as generally benign image files, which is why attackers are now having so much success hiding their nefarious exploits in them.”

Looking at this latest warning, SlashNext’s J Stephen Kowski told me “when you open or preview these ‘images,’ they can secretly redirect your browser to dangerous websites without you knowing.” That means you need to be “extra careful” with images.

Because the latest attacks leverage spoofed domains and senders to trick you, it isn’t as easy as just avoiding emails from unknown senders. Instead, you should delete any email with an .SVG attachment unless you’re expecting it. And you should allow your browser to block external images until you’re certain of their origin.

Kowski says these emails will also likely be “pushy about viewing the image right away,” and while “your email provider’s built-in security features, such as spam filtering and safe attachments, can help, they’re not perfect against these newer tricks.”

Jason Soroko from Sectigo goes even further, warning security teams to “treat every inbound SVG as a potential executable,” as the surge in such attacks continues.

The real threat though lies in user complacency. SVG attacks, VIPRE says, are now tussling with PDFs to become “attackers’ favorite attachments of choice.” These are only images, most users assume, and so no click-throughs, no harm.

Ontinue says “the observed targets of this campaign fall into B2B Service Providers, including the ones handling valuable Corporate Data regularly, including Financial and Employee data, Utilities, Software-as-a-Service providers that are great social engineering targets as they expect to receive a high volume of emails.”

And the team warns “this technique demonstrates how adversaries are shifting away from executable payloads and towards smuggling (HTML and now SVG) techniques. By embedding script logic into image formats and using trusted browser functions, the attack chain avoids triggering traditional behavioral or signature-based alerts.”

The emails containing the attachments or links will be simple, “using a minimal format to avoid detection and provoke curiosity or interaction.” Hijacking poorly protected domains or spoofing others with special characters enhances the lure.

The advice is just as simple. If you’re not expecting an email which includes image links or .SVG attachments, delete them from your inbox. “This campaign highlights a creative pivot in attacker methodology,” the team says, “using benign file formats to hide malicious logic and evade established detection controls.”

Which is another way of saying that you’re your own best defense.