Scripting Vector Grifts: SVG phishing with smuggled JS and adversary in the middle tactics · Blog · Sublime Security

This report describes an active credential-phishing campaign that uses malicious SVG attachments containing embedded JavaScript to redirect victims to attacker-controlled pages that perform fake verification and a spoofed Microsoft login. The attack implements an AITM technique that forwards harvested credentials to the real Microsoft authentication service for validation, increasing the likelihood of capturing valid credentials; Sublime details detection signals (embedded JS in SVG, voicemail lures, unknown senders) and its detection rule that blocks these emails.