Get the latest tech news

Hackers Weaponizing SVG Files With Malicious Embedded JavaScript to Execute Malware on Windows Systems

Hackers exploit SVG files to deliver JavaScript malware on Windows, turning images into stealthy phishing tools that bypass standard defenses.

Unlike standard image formats such as JPEG or PNG that store pixel data, SVG files utilize XML-based code to define vector paths, shapes, and text elements. Seqrite security researchers have identified a sophisticated campaign employing this technique, observing attackers distributing malicious SVG files through spear-phishing emails with deceptive subject lines like “Reminder for your Scheduled Event” and attachments named “Upcoming Meeting.svg” or “Your-to-do-List.svg.” The attack demonstrates remarkable technical sophistication, with threat actors leveraging multiple evasion techniques to maintain persistence and avoid detection by traditional security solutions.

Get the Android app