An ordinary missed call notification subtly transformed into a dangerous shell for malicious code. Between June 1st and August 4th, 2026, INKY security specialists identified a massive phishing campaign. This aggressive operation dispatched exactly 26,589 deceptive emails targeting 5,527 distinct organizations. The distribution pattern was incredibly broad. While one-third of the targeted companies received only a single email, the median volume was two messages per organization.
The Mechanics of the Phishing Lure
The fraudulent emails perfectly mimicked internal corporate voicemail notifications. They specifically included one or more attached files bearing the `.svg` extension. In an overwhelming 99.5% of instances, the attackers deliberately inserted the portion of the recipient’s email address preceding the `@` symbol directly into the subject line. This tactic successfully created a convincing illusion of a personalized, legitimate message. However, bizarre greetings directed at automated service mailboxes exposed the forgery. For example, generic terms like “Accountspayable” appeared absurdly instead of a proper human name.
Exploiting the SVG Format
An SVG essentially functions as a vector image strictly based upon XML architecture. However, this flexible format dangerously permits the direct embedding of executable JavaScript. The insidious “SVG Smuggling” technique involves covertly concealing executable malicious code directly inside an outwardly harmless image file. During this specific campaign, the senders deliberately mislabeled the attachment’s MIME type as `text/plain`. Consequently, any security filter blindly trusting the declared content type would mistakenly analyze the dangerous file as standard, harmless text.
Obfuscated JavaScript and Delayed Execution
Hidden deeply within a minimal graphical shell lay heavily obfuscated JavaScript code. This code meticulously assembled the address of a remote command server utilizing disjointed numerical values. Furthermore, it purposefully delayed execution before finally utilizing the `fetch` function to download the subsequent attack phase. The SVG file itself did not contain a complete, ready-to-use data theft page. The report authors strongly assess that a fraudulent phishing form represents the most typical, logical continuation of such sophisticated attacks.
Bypassing Microsoft Security Filters
INKY successfully flagged every single email intercepted by its telemetry as dangerous. Their proprietary filter comprehensively analyzed the attachment’s true content, the deceptive voicemail lure, and the falsified internal sender address. Conversely, Microsoft’s built-in security checks performed poorly. They assigned a low Spam Confidence Level (SCL) of 0 or 1 to a staggering 75% of these malicious messages. This low score typically guarantees direct delivery into the user’s primary inbox. Shockingly, Microsoft successfully recognized merely 18% of these emails as actual spam.
Essential Defensive Recommendations
Security experts strongly recommend that all organizations proactively inspect SVG files as active, potentially hostile content. They must enforce this inspection regardless of the officially declared MIME type. Administrators should immediately quarantine such attachments or block them entirely if absolutely no legitimate business necessity exists. Furthermore, security systems must reliably identify and intercept emails attempting to spoof internal addresses while originating from external, unauthenticated sources. Finally, users must never inherently trust unexpected SVG files or suspicious login pages originating from any attachment.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
