Threat Actors Exploit SVG Files in Stealthy JavaScript Redirects

A phishing campaign is abusing SVG image files by embedding JavaScript that decrypts a secondary payload via a static XOR key and redirects victims in-browser to attacker-controlled domains (often with Base64 tracking). Attackers use spoofed sender addresses, geofencing, and short-lived randomized domains to evade detection while targeting B2B service providers; recommended mitigations include blocking or stripping scripts from SVGs, enforcing DMARC, enabling Safe Links/Safe Attachments, and improving telemetry to detect browser-based pivots.