Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Threat actors are increasingly using Scalable Vector Graphics (SVG) files to deliver JavaScript-based redirect attacks. These SVGs contain embedded, obfuscated JavaScript that initiates browser redirects to attacker-controlled infrastructure. The campaign uses email spoofing and impersonation to deliver the SVGs, bypassing traditional file-based detection. The embedded code uses XOR encryption and reconstructs the redirect command at runtime. The attack targets B2B Service Providers, including those handling corporate financial and employee data. Mitigation strategies include implementing DMARC policies, blocking SVG attachments, and enhancing email security measures. The campaign demonstrates a shift towards smuggling techniques that avoid triggering traditional security alerts.

The threat campaign titled "SVG Smuggling - Image Embedded JavaScript Redirect Attacks" involves the use of Scalable Vector Graphics (SVG) files as a vector for delivering malicious JavaScript payloads. Attackers embed obfuscated JavaScript code within SVG files, which are then delivered primarily via email through spoofing and impersonation techniques. The embedded JavaScript is XOR-encrypted and reconstructed at runtime within the victim's browser, enabling the execution of redirect commands that send users to attacker-controlled infrastructure. This method effectively bypasses traditional file-based detection mechanisms because SVG files are typically considered safe image files and are less scrutinized by security controls. The campaign targets B2B service providers, especially those managing sensitive corporate financial and employee data, indicating a focus on organizations with valuable business information. The attack leverages multiple adversary tactics including obfuscation (XOR encryption), phishing (email spoofing and impersonation), and command and control communication via browser redirects. The campaign represents an evolution in smuggling techniques, where malicious code is hidden inside seemingly benign file formats to evade detection. Mitigation strategies recommended include implementing strict DMARC policies to reduce email spoofing, blocking or restricting SVG attachments in email gateways, and enhancing email security measures such as advanced threat protection and user awareness training. The campaign does not currently have known exploits in the wild but represents a medium-severity threat due to its stealthy nature and potential impact on targeted organizations.

Detailed information about SVG Smuggling - Image Embedded JavaScript Redirect Attacks. Get real-time updates, technical details, and mitigation strategies.

SVG Smuggling - Image Embedded JavaScript Redirect Attacks - Live Threat Intelligence - Threat Radar | OffSeq.com

SVG Smuggling - Image Embedded JavaScript Redirect Attacks

A sophisticated phishing campaign has been identified that leverages Google Apps Script to create a false sense of security. The attack begins with an email masquerading as an invoice, containing a link to a webpage hosted on Google's trusted environment. When clicked, the link redirects to a fake invoice page, followed by a fraudulent login window designed to capture credentials. The use of Google's domain (script.google.com) adds credibility to the scam, making it more likely for users to fall victim. Once credentials are entered, they are transmitted to the attacker, and the user is redirected to a legitimate Microsoft login page to avoid suspicion. This technique demonstrates how threat actors are exploiting trusted platforms to make their attacks more convincing and effective.

This threat describes a sophisticated phishing campaign that exploits Google Apps Script to conduct credential theft attacks by leveraging the inherent trust users place in Google's domains. The attack initiates with a phishing email impersonating an invoice notification, containing a link hosted on script.google.com, a legitimate Google domain. When the victim clicks the link, they are redirected to a fake invoice webpage crafted within Google's trusted environment using Google Apps Script. Subsequently, the victim encounters a fraudulent login prompt mimicking the Microsoft login interface, designed to capture their credentials. After the user submits their credentials, the data is transmitted to attacker-controlled infrastructure identified by the IP address 167.250.5.66 and the domain solinec.com. To avoid raising suspicion, the victim is then redirected to the legitimate Microsoft login page, making the entire interaction appear seamless and authentic. This attack combines social engineering, domain spoofing, and abuse of trusted cloud platforms to bypass traditional security filters and user skepticism. The use of Google Apps Script enables hosting malicious content on a domain less likely to be blocked by email or web filters, increasing the likelihood of successful exploitation. The campaign aligns with multiple MITRE ATT&CK techniques including phishing (T1566), credential theft (T1528), input capture (T1056), user execution (T1204), and others. Notably, this attack does not exploit software vulnerabilities but relies heavily on social engineering and user trust in cloud platforms and well-known brands.

Detailed information about Behind the Script: Unmasking Phishing Attacks Using Google Apps Script. Get real-time updates, technical details, and mitigation stra

Title	Severity	Type	Source	Date

Threats Tagged 'email spoofing'

Filter Threats

Threats Tagged 'email spoofing'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility