SVG Phishy Attachments

The latest tool in the hacker’s arsenal is the SVG file. We should all be wary of email attachments and really be sure of their legitimacy before attempting to open them.
​
There's a new and sneaky way hackers are trying to trick people, and it involves something you might think is harmless: image files. Cybersecurity experts recently discovered a new wave of phishing emails that are using special image files called SVGs to sneak past your email security and steal your information.

Think of an SVG file like a super-smart picture. Unlike regular photos you take with your phone, SVGs are actually based on text. This means they can do more than just show a picture; they can also contain hidden instructions, like tiny computer programs. This makes them great for websites because they can look good on any screen size and even be interactive. But now, bad guys are using this clever feature against us.

Here's the trick: hackers are putting secret instructions inside these SVG image files. When you open the SVG file (which might look like a simple invoice or a document), those hidden instructions kick in. They tell your computer to automatically send you to a fake website that looks exactly like a real one, perhaps your bank or a well-known online service. Their goal? To get you to type in your usernames and passwords, which they then steal.

What makes this so tricky is that many security tools are designed to spot typical dangerous files like Word documents with tricky macros or PDF files. But because SVGs are often seen as innocent image files, these tools might not look inside them for hidden dangers.

Watch out for Phishy emails especially as specific events are nearing. Tax time is a good one.
​

Ep337

Image Source: Screenshot taken by MITE Radio