Hidden in plain sight: How SVGs carry malicious scripts

The report describes an observed uptick in malicious SVG files in early 2026 that abuse embedded JavaScript to implement three main attack types—redirectors, self-contained phishing pages, and DOM/script abuse—highlighting examples from ReversingLabs including a WordPress brute-force script and spearphishing voicemail attachments; researchers extracted multiple domains and numerous file hashes and recommend filtering SVG attachments and stronger anti-phishing controls.