Reddit NetSec

AlienVault OTX General

CVE Database V5

Exploit-DB RSS Feed

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Threat actors are increasingly using Scalable Vector Graphics (SVG) files to deliver JavaScript-based redirect attacks. These SVGs contain embedded, obfuscated JavaScript that initiates browser redirects to attacker-controlled infrastructure. The campaign uses email spoofing and impersonation to deliver the SVGs, bypassing traditional file-based detection. The embedded code uses XOR encryption and reconstructs the redirect command at runtime. The attack targets B2B Service Providers, including those handling corporate financial and employee data. Mitigation strategies include implementing DMARC policies, blocking SVG attachments, and enhancing email security measures. The campaign demonstrates a shift towards smuggling techniques that avoid triggering traditional security alerts.

The threat campaign titled "SVG Smuggling - Image Embedded JavaScript Redirect Attacks" involves the use of Scalable Vector Graphics (SVG) files as a vector for delivering malicious JavaScript payloads. Attackers embed obfuscated JavaScript code within SVG files, which are then delivered primarily via email through spoofing and impersonation techniques. The embedded JavaScript is XOR-encrypted and reconstructed at runtime within the victim's browser, enabling the execution of redirect commands that send users to attacker-controlled infrastructure. This method effectively bypasses traditional file-based detection mechanisms because SVG files are typically considered safe image files and are less scrutinized by security controls. The campaign targets B2B service providers, especially those managing sensitive corporate financial and employee data, indicating a focus on organizations with valuable business information. The attack leverages multiple adversary tactics including obfuscation (XOR encryption), phishing (email spoofing and impersonation), and command and control communication via browser redirects. The campaign represents an evolution in smuggling techniques, where malicious code is hidden inside seemingly benign file formats to evade detection. Mitigation strategies recommended include implementing strict DMARC policies to reduce email spoofing, blocking or restricting SVG attachments in email gateways, and enhancing email security measures such as advanced threat protection and user awareness training. The campaign does not currently have known exploits in the wild but represents a medium-severity threat due to its stealthy nature and potential impact on targeted organizations.

Detailed information about SVG Smuggling - Image Embedded JavaScript Redirect Attacks. Get real-time updates, technical details, and mitigation strategies.

SVG Smuggling - Image Embedded JavaScript Redirect Attacks - Live Threat Intelligence - Threat Radar | OffSeq.com

SVG Smuggling - Image Embedded JavaScript Redirect Attacks

A resurgence in malicious campaigns exploiting deceptive CAPTCHA verifications has been observed, tricking users into executing NodeJS-based backdoors and deploying sophisticated Remote Access Trojans. The attack begins with a malicious NodeJS script connecting to attacker-controlled infrastructure, remaining passive until further commands are received. An advanced NodeJS RAT variant capable of tunneling malicious traffic through SOCKS5 proxies and using XOR-based encryption was uncovered. The campaign, known as KongTuke, uses compromised websites as initial access points. The malware employs anti-VM mechanisms, collects system information, and establishes persistence. It includes features for command execution, payload dropping, and covert communication. The RAT's functionality includes detailed system reconnaissance, remote command execution, and network traffic tunneling.

The threat known as Yet Another NodeJS Backdoor (YaNB) represents a sophisticated malware campaign leveraging NodeJS-based backdoors to establish persistent and covert control over compromised systems. The attack vector begins with deceptive CAPTCHA verifications that trick users into executing malicious NodeJS scripts. These scripts connect to attacker-controlled infrastructure and remain dormant until receiving further commands, enabling stealthy operation. The malware, attributed to the adversary group KongTuke, is an advanced Remote Access Trojan (RAT) variant that supports tunneling malicious traffic through SOCKS5 proxies, enhancing its ability to evade network detection and facilitate lateral movement or data exfiltration. Communication between the malware and its command and control (C2) servers employs XOR-based encryption, adding a layer of obfuscation to hinder analysis and detection. The campaign uses compromised legitimate websites as initial access points, increasing the likelihood of victim infection through trusted sources. The malware incorporates anti-virtual machine (anti-VM) techniques to avoid sandbox analysis, collects detailed system information for reconnaissance, and establishes persistence mechanisms to survive reboots and maintain long-term access. Functional capabilities include remote command execution, payload dropping for additional malware deployment, and covert communication channels. The use of NodeJS as the platform for the backdoor is notable, as it allows cross-platform compatibility and leverages the widespread use of NodeJS in modern web and server environments. Although no specific affected software versions are listed, the threat targets environments where NodeJS scripts can be executed, potentially including development, testing, and production systems that run NodeJS applications or have NodeJS runtime installed. The campaign is currently assessed as medium severity, with no known exploits in the wild beyond the described infection vector.

Detailed information about Yet Another NodeJS Backdoor (YaNB): A Modern Challenge. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'xor encryption'

Filter Threats

Threats Tagged 'xor encryption'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility