Hackers Weaponize SVG Files and Office Documents to Target Windows Users

Researchers uncovered a sophisticated multi-vector phishing campaign targeting manufacturing and government organizations in Italy, Finland, and Saudi Arabia that uses weaponized Office documents (CVE-2017-11882), malicious SVGs/LNKs, and RAR-wrapped JavaScript to initiate a four-stage loader. The chain includes steganographically embedded .NET assemblies hosted on legitimate services, a trojanized TaskScheduler library, in-memory payload loading and process hollowing into RegAsm.exe, plus a UAC bypass to deploy information stealers and RATs (PureLog, Katz, DC Rat, Async Rat, Remcos); recommended mitigations include enhanced email filtering, disabling legacy Equation Editor components, inspecting image attachments, and monitoring PowerShell/process activity.