Hackers Using SVG Files to Deliver Malicious Payloads

A recent Latin American malware campaign demonstrates how cybercriminals are evolving by weaponising oversized SVG files that carry the entire payload, including a remote-access trojan, without any external downloads. Victims are targeted with emails that mimic trusted institutions, using urgent language to prompt clicking or opening attachments.

The campaign embeds AsyncRAT directly inside the SVG’s XML code, bypassing traditional dropper steps and enabling keystroke logging, screen capture, and credential theft, while DLL sideloading installs AsyncRAT to grant persistent access. One sample SVG (SHA1: 0AA1D24F40EEC02B26A12FBE2250CAB1C9F7B958) triggers a password‑protected ZIP download, where the password reinforces the impression of legitimacy.

Security researchers note that SVG files are treated as benign graphics by many tools, contributing to the effectiveness of this technique, which has been added to the MITRE ATT&CK framework under obfuscation technique T1027.017 as “SVG smuggling.” Infections appeared to spike mid‑week in August, with Colombia bearing the brunt of the activity.