Researchers reported a rise in malicious SVG files in early 2026, where attackers abuse embedded JavaScript to build fake login pages, redirect victims, exfiltrate inputs, and deliver malicious downloads. ReversingLabs also found SVG-based spear phishing attachments disguised as voicemail notices and linked to domains such as chx[.]js, pinche[.]php, 01058telecom[.]de, qedhsp[.]cprltdf[.]es, and wihportal[.]sbs. #SVG #ReversingLabs #Wordpress #chxjs #pinchephp #01058telecom #qedhspcprltdfes #wihportalsbs
Keypoints
- Malicious SVG use increased in early 2026, with threat actors abusing the format’s JavaScript support.
- SVG files are often overlooked because they appear to be harmless images, helping them bypass security controls.
- Attackers used SVGs as redirectors, self-contained phishing pages, and for DOM injection/script abuse.
- One observed sample functioned like a full webpage, generating a user ID, collecting search inputs, and contacting external scripts.
- Another wave of SVGs was used in spear phishing campaigns posing as voicemail attachments.
- The voicemail-themed SVGs targeted healthcare, construction, and banking sectors, including administrative, financial, CEO, and finance contacts.
- Researchers extracted obfuscated domains from samples, but could not access the contents of the destination sites.
MITRE Techniques
- [T1056 ] Input Capture – SVG scripts collected user-entered search data and sent it to an external server (‘sending back the inputs from the search bar’).
- [T1185 ] Browser Session Hijacking – Embedded JavaScript executed in the browser to interact with the page and user activity (’embedded Javascript will execute as a default’).
- [T1204 ] User Execution – Victims had to click the SVG image/attachment to trigger the malicious redirect or payload (‘users click an image … to be redirected’).
- [T1566.001 ] Spearphishing Attachment – SVG files were delivered as fake voicemail attachments targeting specific people and departments (‘SVG attachments appeared to be designed to masquerade as fake voicemail attachments’).
- [T1036 ] Masquerading – The files pretended to be benign images or voicemail notices to evade suspicion (‘assumed to be harmless file into something dangerous’).
- [T1202 ] Indirect Command Execution – The SVG loaded external JavaScript from a separate domain to perform the brute-force function (‘the script calling to the chx[.]js domain’).
- [T1059.007 ] JavaScript – Malicious actions were implemented through embedded JavaScript inside SVG files (‘possible to embed Javascript with SVG files’).
- [T1210 ] Exploitation of Remote Services – The referenced chx[.]js infrastructure was associated with forcing browsers to brute-force WordPress passwords (‘force victims’ browsers into brute-forcing passwords on WordPress sites’).
Indicators of Compromise
- [Domains/URLs ] Malicious redirect and payload infrastructure found in SVG samples – 01058telecom[.]de, qedhsp[.]cprltdf[.]es, wihportal[.]sbs
- [Domains/URLs ] External script and phishing-related infrastructure referenced in the article – chx[.]js, pinche[.]php
- [Email addresses ] Target emails embedded in voicemail-themed SVG spearphishing files – administrative/financial department addresses, CEO/finance manager addresses
- [File hashes ] Sample hashes extracted from analyzed SVG files – d9e4ae7bf23b5c6691156a6fa7fb128ea68905840d289ae3837acc7d076b770b6, cec2a1d8b0fabf0d632cad92dd560374eef427930cbef562b309067c5329cfae6d94b2ba9dddaa20b1725a51104581c, and 8 more hashes
Read more: https://www.reversinglabs.com/blog/how-svgs-carry-dangerous-scripts