Threat Research

A recent phishing campaign targeting Ukraine uses malicious SVG files disguised as official government communication. When opened, the SVG file downloads a password-protected archive containing a CHM file, which triggers a chain of malware execution via HTA CountLoader....

The blog explores the growing use of Scalable Vector Graphics (SVG) files in phishing and malware campaigns. SVG files, which are based on XML, can embed malicious JavaScript, making them an attack vector. The blog focuses on one technique—standalone SVG attachments—where malicious files trigger automatic browser redirects when opened, bypassing URL scanning protections....