Cybercriminals Weaponize Graphics Files in Phishing Attacks

Sophos researchers report an active phishing campaign abusing SVG image files to bypass email/security filters and present convincing, embedded login dialogs (often impersonating DocuSign, SharePoint, Dropbox, Microsoft) that capture and exfiltrate credentials to attacker-controlled domains or services; the technique has been observed since late 2024 and accelerated in January 2025.