Attackers are now leveraging encrypted phishing emails that utilize Scalable Vector Graphics (SVG) files to execute malicious JavaScript code.
The phishing campaign begins with an email masquerading as a notification for a new voice message.
Recipients are prompted to click on a link to access this message, a classic attraction that plays on human curiosity and the urgency of communication.
Upon clicking the link, the target is taken to a page loaded with heavily obfuscated HTML data.
This is where the attackers’ creativity comes into play. They embed JavaScript code within an SVG image that is executed once the page is rendered on the victim’s system.
Trustifi’s Advanced threat protection prevents the widest spectrum of sophisticated attacks before they reach a user’s mailbox. Stopping 99% of phishing attacks missed by
other email security solutions. .
This new tactic, uncovered by ARC Labs, a division of Binary Defense, marks a concerning evolution in phishing campaigns, aiming to harvest credentials by tricking targets with seemingly innocuous voice message notifications.
SVG: A Vector for Attack
SVG files, commonly used for their scalability and quality in web graphics, are now being weaponized to execute JavaScript.
This method is particularly insidious as it bypasses traditional security measures that may not scrutinize image files for malicious code.
Encrypted Data and the Second Stage
Within the SVG, ARC Labs discovered encrypted data that, when decrypted, revealed a second stage in the phishing attack.
This stage prompts the victim to enter their credentials to access the voice message.
The decryption of this data is facilitated by CryptoJS, a library that allows for the encryption and decryption of data within JavaScript.
The complexity of this attack lies in the encryption of the second-stage page data across multiple HTML classes, which is dynamically decrypted using CryptoJS.
This approach not only conceals the malicious intent but also complicates the analysis and detection of the phishing attempt.
ARC Labs’ analysis of the JavaScript code during runtime was crucial in uncovering the mechanics of this attack.
By setting breakpoints at every invocation of CryptoJS, researchers recovered the decryption key, a critical step in decrypting the content and understanding the full scope of the phishing attempt.
This case study is a stark reminder of the evolving landscape of cyber threats and the innovative methods attackers employ to compromise personal information.
Users are urged to exercise caution when emails prompt action, especially those that lead to external pages requesting credential input.
For organizations, the importance of comprehensive security measures, including the analysis and understanding of emerging threats, cannot be overstated.
As attackers refine their techniques, staying informed and vigilant is the best defense against these encrypted phishing attacks.
The weaponization of SVG files in phishing campaigns represents a significant shift in the tactics used by cybercriminals.
Attracting malicious JavaScript code from encrypted data in SVG images, attackers find new ways to bypass security measures and exploit human vulnerabilities.
The analysis conducted by ARC Labs illuminates this sophisticated attack method, offering valuable insights into its mechanics and emphasizing the need for heightened awareness and security practices.
Secure your emails in a heartbeat! To find your ideal email security vendor, Take a Free 30-Second Assessment.