Fake Voicemail SVG Attachments Fuel Large-Scale Phishing Campaign

INKY reported a two-month phishing campaign (June 1–August 4, 2026) that sent 26,589 voicemail-themed messages to 5,527 organizations using SVG/XML attachments which declared a harmless MIME type (text/plain) while embedding obfuscated JavaScript; the code reconstructed strings at runtime and fetched remote endpoints. The operation relied on internal sender spoofing and recipient-specific personalization, ran in waves (largely stopping on weekends), and bypassed native filters — 75% of messages received Microsoft SCL 0 or 1 — demonstrating scalable evasion techniques rather than targeted spear-phishing.