This threat involves phishing emails delivering SVG attachments containing embedded JavaScript. The JavaScript uses Base64 encoding combined with XOR obfuscation to hide a redirect URL. When the SVG is opened in a browser, the script decodes the payload and redirects the user to a phishing page, appending the targeted email address as a parameter. The use of the official ECMAScript MIME type helps evade some security filters. The campaign exploits the default browser behavior of rendering SVG files on Windows systems. The phishing domains use the .cfd TLD, known for low-cost registrations and abuse in phishing.

The impact is limited to phishing attacks that redirect users to fraudulent websites aiming to steal credentials or other sensitive information. There is no indication of malware installation or exploitation of software vulnerabilities. The threat leverages social engineering and browser behavior to bypass some security controls.

No official patch is applicable since this is a phishing technique rather than a software vulnerability. Users and organizations should block or filter emails with suspicious SVG attachments and educate users about this phishing method. Security controls should be updated to detect and block SVG files containing embedded scripts, especially those using the application/ecmascript MIME type. Since this technique is known, security products may already have mitigations in place.