Phishing attacks leveraging HTML code inside SVG files

Phishing actors are increasingly using SVG image attachments (which can contain embedded HTML/JavaScript) to host or launch credential-harvesting pages and redirection scripts. Kaspersky telemetry observed a rising trend in early 2025, with 2,825 SVG-bearing phishing emails in Q1 and 1,324 in the first half of April, indicating active campaigns that can bypass some defenses by presenting as images while executing web-based phishing behaviors.